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FOIPA  Request  No.:  1329073-000 
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Dear  Ms.  O’Brien: 

Records  responsive  to  your  request  were  previously  processed  under  the  provisions  of  the  Freedom 
of  Information  Act.  Enclosed  is  one  CD  containing  605  pages  of  previously  processed  documents  and  a  copy 
of  the  Explanation  of  Exemptions.  Please  be  advised,  these  are  the  only  copies  of  these  documents  located 
in  our  possession.  The  original  copies  of  these  documents  could  not  be  located  for  reprocessing. 

Additional  records  potentially  responsive  to  your  subject  exist.  The  Federal  Bureau  of  Investigation 
(FBI)  has  located  approximately  1,594  pages  total  of  records  potentially  responsive  to  the  subject  of  your 
request.  By  DOJ  regulation,  the  FBI  notifies  requesters  when  anticipated  fees  exceed  $25.00. 

If  all  potentially  responsive  pages  are  released  on  CD,  you  will  owe  $40.00  in  duplication  fees  (3  CDs 
at  $15.00  each,  less  $5.00  credit  for  the  first  CD).  Releases  are  made  on  CD  unless  otherwise  requested. 
Each  CD  contains  approximately  500  reviewed  pages  per  release.  The  500  page  estimate  is  based  on  our 
business  practice  of  processing  complex  cases  in  segments. 

Should  you  request  that  the  release  be  made  in  paper,  you  will  owe  $79.70  based  on  a  duplication 
fee  of  five  cents  per  page.  See  28  CFR  §16.10  and  16.49. 

If  you  agree  to  receive  all  responsive  material  on  CD,  you  will  receive  a  $5.00  credit  towards  your  first 
interim  CD.  As  a  result,  we  must  notify  you  there  will  be  a  $25.00  charge  when  the  second  interim  release  is 
made  in  this  case.  At  that  time  you  will  be  billed  for  the  $1 0.00  remaining  from  the  $1 5.00  free  of  the  first 
release,  as  well  as  the  $15.00  duplication  fee  for  the  second  release,  for  a  total  of  $25.00. 

Please  remember  this  is  only  an  estimate,  and  some  of  the  information  may  be  withheld  in  full 
pursuant  to  FOIA/Privacy  Act  Exemptions(s).  Also,  some  information  may  not  be  responsive  to  your  subject. 
Thus,  the  actual  charges  could  be  less. 


You  may  file  an  appeal  by  writing  to  the  Director,  Office  of  Information  Policy  (OIP),  United  States 
Department  of  Justice,  Suite  11050,  1425  New  York  Avenue,  NW,  Washington,  D.C.  20530-0001,  or  you 
may  submit  an  appeal  through  OIP's  FOIAonline  portal  by  creating  an  account  on  the  following  web 
site:  https://foiaonline.regulations.gov/foia/action/public/home.  Your  appeal  must  be  postmarked  or 
electronically  transmitted  within  sixty  (60)  days  from  the  date  of  this  letter  in  order  to  be  considered  timely.  If 
you  submit  your  appeal  by  mail,  both  the  letter  and  the  envelope  should  be  clearly  marked  “Freedom  of 
Information  Act  Appeal.”  Please  cite  the  FOIPA  Request  Number  assigned  to  your  request  so  that  it  may  be 
easily  identified. 


Sincerely, 


David  M.  Flardy 
Section  Chief, 
Record/Information 


Dissemination  Section 
Records  Management  Division 
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(THROUGH  7/28/00) 

PAGES  REVIEWED:  154 

PAGES  RELEASED:  154 

EXEMPTIONS  CITED:  b6-l,  b7C-l, 

b6-3  &  b7C-3 
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Internet  Companies  Decry  FBI’s 
E-Mail  Wiretap  Plan 
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to  outside  a*idi£,  boreati  says  that  it 
mvmped  the  Carnivore  system  precisely 
to  attorns  the  same  privacy  concerns  that 
many  toten^t  providers  have,  FBIfedmir 
asm  also  toe  tiled  to  recent  weeks  to 
explain  to  Industry  specialists  how  Carni¬ 
vore  «Hta,  partly  to  silay  feats  that  the 
system  might  he  open  to  abuse. 

Still,  there  is  a  drive  afoot  in  the  Inter- 
,Mt  Industry  to  create  a  more  open  sotu- 
Um  that  could  replace  Carnivore,  Industry 
experts  argue  that  creating  their  oto  de¬ 
vice  would  Jesses  suspicions  and  allow  for 

dicker  modifications  as  Internet  proto* 
ettfs  change.  The  FBI  says  that  a  small 
number  of  Internet  providers  already  have 
built-in  capacities  to  meet  federal  wiretap 
requests.  Carnivore  is  required  Jor  those 
that  don’t  have  the  ability  to  do  the  wire- 
taps  themselves, 

^  -Neil  King  Jr. 
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4^nil  and  join  a  discussion  about  privacy 
and  the  Internet  in  the  online  Journ  al 

at  WSJ^cm. 
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FBI  Internet 


Of  Privacy 

New  System  Tracks 
Suspects  Online 

Bf  JOHtf  $CKTOUft2 
gfohwgtan  Pott  Staff  Bftitfr 

The  FBI  has  deployed  m  mi& 
mated  syst  em  to  wiretap  the  Inter- 
net*  giving  authorities  a  new  tool 
to  police  cyberspace  bat  drawing 
concerns  among  dvii  libertarians 
and  privacy  advocates  about  how  it 
might  be  used. 

The  new  computer  system, 
dubbed  "Carnivore"  inside  the  FBI 
because  it  rapidly  finds  the  "meal" 
is  vast  amountsof  data*  was  devel¬ 
oped  at  FBI  computer  labs  m 
Quant ico,  V&.,  and  has  been  used 
in  fewer  than  50  cases  so  far, 
i  But  that  number  is  sure  to  rise, 

I  said  Marcus  Thomas*  chief  of  the 
;  FBfs  cyber-technology  section  at 

j  Quajntico.  "In  criminal  situations' 

there's  not  yet  been  a  large  call  for 
>C  he  said,  but  the  bureau  already 
has  seen  "growth  in  the  rate  of  re¬ 
quests," 

Civil  liberties  groups’  said  the 
new  system  raises  troubling  issues 
\  about  what  constitutes  a  reason¬ 
able  search  an  d  seizure  of  electron' 
ic  data.  In  sniffing  out  potential 
criminal  conduct*  the  new  technol- . 
ogy  also  could  scan  private  in- 
formation  about  legal  activities. 

*Tt  goes  to  thedheart  of  how  the 
Fourth  Amendment  and  the  feder¬ 
al  wiretap  statute  are  going  to  be 
allied  in  the  Internet  age**  said 
Marc  Rotenberg*  head  of  the 
Washington-based  Electronic  Pri¬ 
vacy  Information  Center, 
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The  new  system*  which  operates  on  off- 
the-shelf  personal  computers,  takes  ad¬ 
vantage  of  one  of  the  fundamental  princi¬ 
ples  of  the  Internet  that  virtually  ah  such 
communications  are  broken  up  into  "pack- 
tisT  or  uniform  chunks  of  data.  Computers 
on  the  Internet  break  tip  e-mafi  messages. 
World  Wide  Web  rite  traffic  and  other  in¬ 
formation  into  pieces  and  route  the  packets 
across  the  ^ot^netwcrk,- where  ibev  are 
reassembled  os  the  other  end  , 

FBI  programmers  devised  a  "packet  sniff¬ 
er*  system  that  can  analyze  data  Sowing 
through  computer  networks  to  determine 
whether  it  is  part  of  an  e-mail  message  or 
some  other  piece  of  Web  traffic. 

The  ability  to  distinguish  between  pack¬ 
ets  rilows  law  enforcement  officials  to  tailor 
their  searches  so  that*  for  example*  they  can 
exarmae  email  but  leave  alone  a  suspect's 
online  shopping  activities.  The  system 


could  be  tuned  to  do  as  little  as  monitoring 
hm  many  e-mail  messages  the  suspect 
££nd$  and  to  whom  they  arc  addressed — 
the  equivalent  of  a  telephone  '"pen  regist  er " 
which  takes  down  telephone  numbers  being 
called  without  grabbing  the  content  of  those 
calls, 

That*s  the  good  news**  said  James 
Dempsey  an  analyst  with  the  Center  for  De~  - 
moeracy  and  Technology;  a  Washington 
high-tech  policy  group.  "It  is  a  more  dis¬ 
criminating  device"  than  a  full  wiretap*  he 
said. 

But  Dempsey  expressed  worries  about 
the  new  system*  which  would  be  installed  al 
the  offices  of  a  suspect's  Internet  service 
provider.  Just  as  the  device  could  be  used  to  ■ 
fine-tune  a  search*  it  also  could  used  for 
broad  sweeps  of  data.  The  bad  news  Is  that 
Itfs  a  black  box  the  government  wants  to  in¬ 
sert  into  the  premises  of  a  service  provider. 
Nobody  (mows  that  It  does  what  five  govern- 
ment  claims  it  would  do  *  Dempsey  said.* 


Existence  of  the  Carnivore  system  was 
discussed  in  a  Wall  Street  Journal  article 
yesterday,  which  reported  that  the  FBI 
showed  the  system  to  tdecommunicafcioos 
industry  experts  two  weeks  ago, 

Albert  Gidari  a  lawyer  who  works  for  the 
wireless  industry,  was  present  at  the  FBI 
demonstration.  He  said  the  FBFs  announce¬ 
ment  was  {Mended  to  counter  industry  as¬ 
sertions  that  it  would  be  very  difficult  to 
provide  the  kind  of  penregister  wiretap  ca  : 
pab&tythat  the  agency  wants. 

Since  the  demonstration*  Gidari  said*  one 
faction  within  the  fe&communkatkms  m- 
dushy  was  pteed  with  the  FBTs  efforts. 
But  Gidari  said  the  other  faction  was  say- 
i  mg.  "Writ  a  mfoute-~wbat  are  the  liability 
Issues?  What  am  the  privacy  issues?  We 
don't  want  third-party  software  on  our  sys¬ 
tem.*  >  ' ' 


wiretap.  Gidari  ts  one  of  a  large  number  of 
industry  experts  who  believe  the  law  does 
not  apply  to  wiretapping  the  Internet  "The 
FBI  overreaches  In  everything  they  do  * 
srid  Gidari,  who  is  president  of  G-Sawy,  an 
iMenieteonsdtmgeompany 
A  former  federal  prosecutor  sounded  a 
more  supportive  tone. Tf  what  It  does  is  it 
hefps  comply  with  wiretaps*  and  it  helps 
minimize  what  you're  gettfog-Ho  help  get 
what  .the  court  authorizes  you  to  get— 
there’s  nothing  wrong  with  fC  said  Mark 
K&scb,  now  a  security  consultant  with  Res- 
toa-based  Global  Int<irity, 

SiSl*  Easdi  said  the  technology  raised 
questions  that  have  yet  to  be  fidiy  explored 
by  law  enforcement  The  PC  robooop  exam¬ 
ines  all  packets  coming  through  a  computer 
network  but  gives  five  law  enforcement  offi- 
only  those  packets  related  to  the  sub¬ 
ject  of  the  investigation 
The  stuff  that  is  examined  only  by"  a 
computer  md  hot  by  a  human  befog— was 


m  then  .suggested  an  answer:  It  is  & 
^arch*  but  it  is  to  m  extent  less  Invasive' 
than  it  would  be  it  you  did  not  use  this  tech: 
oology 

.  first  news  of  Carnivore  actually  came* 

m  April  during  congressional  testimony  by' 
\\ztimgton  lawyer  Rohm  ComRever* 
^ho  represented  an  Internet  service  prorid- 
er  that  toed  to  resist  attaching  the  system 
to  its  network.  Com -Revere  suggested  that 
such  a  system  could  be  used  to  track  dS^4 

SJudlLs  arid  ...  _ 


Although  Congress  has  passed  legislation  J* f 

requiring  telephone  companies  to  make  / 

f  Uat*  i  .  _ .  I 


5/24/02  Release  -  Page  2 


Justice,  on  Both  Sides  of  the  Border 


Agustm  Vazquez  Mendoza  landed  on  the 
FBI  s  10  most  wanted  list  four  years  ago  for 
allegedly  ordering  Ms  henchmen  to  kill  a 
Drug  Enforcement  Administration  agent  in 
Anzona,  Now  he’s  under  arrest,  but  in 
Mexico,  which  roust  decide  whether  to  extra¬ 
dite  a  Mexican  citizen  to  face  charges  in  the 
United  States.  Mexican  law  officers  rooanted 
a  nationwide  manhunt  to  capture  Vazquez 
and  certainly  want  him  brought  to  justice, 
but  some  traffickers  have  won  appeals 
against  extradition. 

Most  countries  are  understandably  reluc¬ 
tant  to  hand  over  a  citizen  to  be  tried  in  a  for¬ 
eign  country.  In  addition,  the  language  in  the 
current  Mexico-U.S.  treaties  clearly  specifies 
that  neither  country  is  bound  to  extradite  a 
citizen.  However,  there  are  circumstances  in 
the  Vazquez  case  that  should  make  it  easier 
for  Mexico  to  send  him  off. 


^Since  President  Ernesto  Zedillo  took  office, 
there  has  teen  a  shift  of  attitude  in  Mexico 
on  extradition.  At  least  nine  Mexican  sus¬ 
pects  have  teen  sent  to  be  tried  in  the  United 
States.  In  two  of  those  cases,  the  suspects  al¬ 
legedly  killed  US.  immigration  officials,  in¬ 
viting  comparison  with  the  Vazquez  case. 

According  to  US.  authorities,  Vazquez  or*  j 
dered  the  murder  of  agent  Richard  Pass  in  ’ 
order  to  keep  both  a  drug  delivery  and  the 
$160,000  the  undercover  agent  was  about  to 
pay  for  it. 

Perhaps  the  most  persuasive  argument  is 
that  Vazquez,  who  fled  to  Mexico  after  the 
mitag,  is  not  accused  of  a  crime  in  Mexico 
and  if  he  is  not  extradited  will  have  to  be  set 
free.  Mexico's  foreign  minister  should  con¬ 
sent  to  the  U.S.  extradition  request  and  peti-  ■ 
tion  the  justice  system  to  send  him  north  as  ] 
quickly  as  the  legal  process  sJlows,  f 


n 
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It  Won’t  Install 
Device  for  FBI 


One  of  the  nation's  largest  Internet  ser¬ 
vice  providers,  EarOiLfnk  Inc.,  has  re- 
fysed  10  install  a  new  Federal  Bureau  of 
Investigation  electronic  surveillance  de- 
V*  m  lts  ****<*&.  saying  technical  ad- 
justments  required  to  use  the  device 
caused  disruptions  for  customers. 

The  FBI  has  used  Carnivore,  as  the 
surveillance  device  is  called,  in  a  number 
of  criminal  investigations.  But  EartfcUnfc 
is  the  first  ISP  to  offer  a  public  account  of 


Bp  Wat!  Street  Journal  staff  reporters 
htm  llmgfield,  Ted  Bridis  and  Nml 
King  Jr, 


an  actual  experience  with  Carnivore.  The 
FBI  has  claimed  that  Carnivore  won't  in¬ 
terfere  with  m  ISP's  operations. 

"li  has  the  potential  to  hurt  our  net- 
work,  to  bring  pieces  of  it  down,*  Steve 
Dougherty.  EarthLinK's  director  of  technol¬ 
ogy'  acquisition,  said  of  Carnivore  “It 
could  impact  thousands  of  peopled 
^VTiile  Earth  Link  executives  said  they 
would  continue  to  work  with  authorities  in 
criminal  investigations,  they  vowed  not  to 
allow  the  FBI  to  install  Carnivore  on  the 
company's  network.  The  company  also 
has  substantial  privacy  concerns. 

Earthlink  has  already  voiced  its  ccn- 
cemsin  court.  The  ISP  is  the  plaintiff  in  a 
tgai  fight  launched  a  gainst  Carnivore  ear- 
yea.r  wUh  Qw  help  of  attorney 
Robert  Com -Revere,  according  to  people 
close  to  the  case.  Previously,  the  identity 
of  the  plaintiff  m  the  case,  which  Is  under 
seal  wasn’t  known,  a  federal  magistrate 
ntled  against  EarthUnk  in  the  case  early 
this  year,  forcing  it  to  give  the  FBI  access 
to  us  system.  Mr.  Corn-Re vere  declined  to 
comment. 

EanhLmk's  problems  with  Carnivore 

feeariier  this  year'  when  me  EBf  in- 
?  a“td  *  ******  device  on  its  rtm-ort 
at  a  hub  site  m  PasatJena,  CaSM.  The  mi 
had  a  court  order  that  allowed  it  to  ijistail 
jie  eqinpmem  as  part  of  a  criminal  invest!* 
gation. 


The  FBI  connected  Carnivore,  &  small 
computer  box  loaded  with  sophisticated 
software  for  monitoring  e-mail  and  other 
online  communications,  to  Earthlink's  re¬ 
mote  access  servers,  a  set  of  networking 
equipment  that  answers  incoming  modem 
calls  ^  from  customers.  But  Carnivore 
wasn't  compatible  with  the  operating  sys¬ 
tem  software  on  the  remote  access  serv¬ 
ers.  So  Earthlink  had  to  install  an  older 
version  of  the  system  software  that  would 
work  with  Carnivore,  according  to  Mr. 
Dougherty 

EarihLtnk  says  the  older  version  of  the 

software  caused  Its  remote  access  servers 
to  crash,  which  in  turn  knocked  out  access 
for  s  number  of  its  customers,  Mr,  Dough¬ 
erty  declined  to  specify  how  many,  saying 
only  that  "many*  people  were  affected. 

Earthlink  executives  said  they  were 
also  concerned  about  privacy.  The  com¬ 
pany  said  It  had  no  way  of  knowing 
whether  Carnivore  was  limiting  its  surveil¬ 
lance  to  the  criminal  investigation  at 
hand,  or  was  trolling  more  broadly.  Other 
iSF^  have  said  there  could  be  serious  liabil¬ 
ity  issues  for  them  if  the  privacy  ofindhid- 
uais  not  connected  to  an  investigation  is 
compromised. 

There  ought  to  be  some  transparency 
to  the  methods  and  tools  that  law  enforce- 
menus  using  to  search-and-seise  commu¬ 
nications.”  said  John  R.  I^Galbo,  rice 
president  of  public  policy  at  PSLNet  Inc, 
an  ISP  in  Ashburn,  Va, 

EarthXink  executives  declined  to  sav 
whether  the  company  has  received  court 
jrders  for  Informatjonabou^ther  custom- 
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ers  since  the  disruption  earlier  this  year, 
Earthlnnk  said  it  would  help  authorities  in 
criminal  investigations  using  techniques 
other  than  Carnivore,  .  ‘ 1  ‘  " 

The  FBI  insists  that  Carnivore  doesn't 
affect  the  performance  or  stability  of  an 
Internet  provider's  existing  networks.  The 
bureau  says  Carnivore  passively  monitors 
traffic,  recording  only  Information  that  Is 
relevant  to  FBI  investigations. 

In  some  cases,  the  FBI  said,  the  Inter¬ 
net  prorider  is  equipped  to  turn  over  data 
without  the  use  of  Carnivore.  This  is  com¬ 
mon  In  cases  where  only  e-mail  messages 
are  sought  because  that  type  of  data  can 
easily  be  obtained  through  Jess-intrusive 
means. 

Attorney  General  Janet  Reno  said  yes¬ 
terday  that  she  was  putting  the  system 
under  review.  She  said  the  Justice  Depart¬ 
ment  would  investigate  Carnivore's  consti¬ 
tutional  implications  and  make  sure  that 
the  FBI  was  using  It  In  consistent  and 
balanced  way.* 
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White  House  Proposes  Wiretap  Law 

By  KALPANA  SR1N1VASAH 
7M  Assoc/afetf  Frees 

WASHINGTON  (July  17)  -  The  White  House  proposed  legislation  Monday  to  update  wiretapping  rules  so  that  legal  protections 
currently  applied  to  telephone  calls  are  extended  to  electronic  communication,  such  as  email 

The  plan  would  require  law  enforcement  officials  to  obtain  high-level  approval  before  applying  for  a  court  order  to  intercept  the 
content  of  e-mail  *  in  line  with  current  rules  that  govern  listening  to  phone  calls* 

/ 

"Basically.  the  same  communication,  if  sent  different  ways  *  through  a  phone  caif  ora  dial-up  modem  -  is  subject  to  different  and 
inconsistent  privacy  standards,”  said  White  House  Chief  of  Staff  John  Podesta,  in  announcing  the  proposals,  “it's  time  to  update 
and  harmonize  our  existing  laws  to  give  ail  forms  of  technology  the  same  legislative  protections  as  our  telephone  cassations.*' 

The  measure  also  addresses  so-called  "trap  and  trace*  orders  which  allow  taw  enforcement  officials  to  identify  the  source  of  a 
phone  call  or  an  e-mal,  but  not  intercept  its  content.  Under  the  proposal,  law  enforcement  officials  would  only  need  one  order  to 
trace  an  e-mail  or  a  phone  cadi,  even  though  such  communications  may  travel  through  multiple  phone  carriers  or  internet 
providers. 

Officials  also  could  trace  such  communications  without  prior  approval  in  an  emergency  situation,  such  as  when  a  computer  is 
under  attacK. 

But  for  the  first  time,  the  administration  is  proposing  that  a  federal  or  state  judge  independently  determine  whether  the  facts 
support  such  a  trace  order.  Under  current  roles,  judges  accept  the  declaration  of  law  enforcement  officials  agencies  that  such  an 
order  is  warranted. 
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Those  changes  could  affect  the  new  “Carnivore*  system,  which  the  FB!  is  using  to  obtain  e-mails  of  investigative  subjects  after 
qettlng  a  search  warrant.  Whan  Carnivore  is  placed  at  an  Internet  service  provider,  it  scans  all  incoming  and  outgoing  e-mails  for 
messages  associated  with  the  target  of  a  criminal  probe. 

Under  the  proposed  changes,  if  the  Carnivora  system  is  being  used  to  intercept  the  content  of  electronic  communications,  then 
law  enforcement  officials  would  first  need  high-level  Justice  Department  approval  before  obtaining  a  court  order,  Podesta  said. 
Higher  standards  limiting  its  use  also  would  apply,  he  said*  If  Csmhore  is  being  used  only  to  track  Information;  officials  would 
need  m  independent  judge  to  review  the  tracing  order,  he  added. 


-But  the  American  Civil  liberties  Union  chided  the  administration's  proposals  Monday,  saying  It  should  have  suspended  use  of  the 
system  outright 

"Carnivore  represents  >3  grave  threat  to  the  privacy  of  all  Americans  by  gmng  Jaw  enforcement  agencies  unsupemsed  access  to 
a  needy  unlimited  amount  of  communications  traffic,*  said  Barry  Steinhardti  ACLU  associate  director/ 

Last  week,  ACLU  officials  said  they  were  going  to  use  the  Freedom  of  Information  Act  to  try  to  force  the  FBI  to  disclose  details  of 
the  inner  workings  of  Carnivore,  - 

The  proposed  measures  would  also  address  inconsistencies  in  how  current  law  applies  to  different  networks  carrying  Internet 
traffic.  For  example,  now1  that  cable  systems  are  being  upgraded  to  offer  two-way  services,  laws  that  apply  to  dial-up  modems 
over  phone  Unas  should  be  extended  to  cable  connections*  Podesta  said. 

The  proposal  requires  congressional  approval,  and  several  lawmakers  already  introduced  their  own  versions* 


Hie  Clinton  administration  also  announced  Monday  updates  to  its  export  control  policy  for  powerful  data  and  voice-scrambling 
technology*  Under  the  change,  American  companies  can  sell  encryption  products  to  any  end  user  in  the  European  Union  or 
these  eight  other  trading  partners:  Australia,  Norway,  Czech  Republic,  Hungary,  Poland,  Japan,  New  Zealand  and  Switzerland. 

The  policy  change  will  also  remove  a  previous  technical  review  waiting  period  of  30  days*  ^  5 
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ACLU  Asks  Details 
On  FBFs  New  Plan 
To  Monitor  the  Web 


By  Nick  Wingfield 

Staff  Reporter  *yf  Tm  Wall  Street  JmttmL 

The  American  Civil  Liberties  Union  ts 
seeking  to  force  the  Federal  Bureau  ofim 
vestigatta  to  disclose  the  technical  details 
behind  a  controversial  electronic  somih 
lance  system  created  by  the  bureau. 

The  ACLU,  using  a  novel  tactic  to  Men- 
my  the  monitoring  capabilities  of  the  sys¬ 
tem,  filed  a  Freedom  of  Information  Act 
Hjquest  with  the  FBI  Friday,  asking  the 
bureau  to  release  the  computer  Source 
code"  for  Carnivore,  as  the  surveillance 
'  system  is  called.  The  civSHiberties  group 
also  requested  that  the  FBI  turn  over  ’let¬ 
ters,  correspondence,  tape  recordings, 
notes,  data*  memoranda,  e-mail"  and 
other  information  connected  with  Canrn 
Tore,  The  ACLU  also  ashed  for  informa- 
non  related  to  Omnivore  and  EtherPeek, 
tu^o  other  surveillance  systems  used  in  the 
past  by  the  bureau. 

The  request  reflects  the  growing  con¬ 
cern  among  privacy  groups  and  Internet 
companies  about  the  privacy  implications 
of  Carnivore*  The  FBI  surveillance  sys* 
tern,  a  hardware  device  that  contains  a 
specialised  program  for  tracking  e-mail 
and  other  forms  of  onlme  communication 
has  especially  raised  hackles  among  Inter' 
net  service  providers*  The  FBI  is  attempt- 
mgto  install  Carnivore  on  the  networks  of 
ISPs  as  part  of  specific  criminal  investiga¬ 
tions  of  online  men.  But  ISPs  say  they 
have  no  way  of  knowing  whether  Carni¬ 
vore  is  limiting  the  scope  of  its  surveil¬ 
lance  to  the  cases  at  hand. 

As  a  result;  critics  of  Carnivore  have 
called  on  the  government  to  reveal  the 


technical  capabilities  of  the  system.  Such 
information  could  indicate  whether  Carni¬ 
vore  is  able  to  restrict  its  monitoring  to 
the  communications  of,  say  a  single  crimi¬ 
nal  suspect  while  ignoring  other  data  traf¬ 
fic  irrelevant  to  the  investigation* 

The  source  code  behind  Carnivore 
could  provide  clues  to  those  capabilities. 
Source  code  is  essentially  the  technical 
blueprint  behind  a  program.  The  ACLU 
contends, ,  and  technical  experts  con¬ 
curred,  that  examining  the  source  code 
behind  Carnivore's  proprietary  surveil¬ 
lance  software  could  reveal  something  of 
the  inner  workings  of  the  system. 

The  Electronic  Privacy  Information 
Center,  a  Washington  advocacy  group,  last 
week  also  filed  a  sweeping  Freedom  of 
Information  request  for  "ail  records"  relat¬ 
ing  to  Carnivore,  though  it  didnV  explic¬ 
itly  request  the  system’s  source  code*  “But 
we  made  clear  we  are  seeking  everything 
including  software,"  said  David  Sobol,  a 
privacy  activist  at  the  center. 

If  is  unclear  whether  using  the  Free¬ 
dom  of  Information  Act  will  compel  the 
FBI  to  produce  the  software  behind  Carni¬ 
vore  though.  Bequests  made  under  the  act 
are  normally  used  to  obtain  official  govern¬ 
ment  documents,  not  software  code*  Barry 
SteJnhardL  associate  director  of  the 
ACLU,  said  two  federal  appeais-court  rub 
ings  that  classified  software  code  as  a 
form  of  speech  could  help  his  case, 

**  all  but  certain  they  will  not  want 
to  release  any  information  on  Carnivore, 
and  we  will  probably  have  to  fight  this  in 
the  courts/  Mr*  Sfeinhardt  said  of  the 
FBL  “But  we  think  this  is  worth  fighting 
for. 

The  FBI  didn't  return  calls  seeking 
comment  on  the  Freedom  of  Information 
request 

As  the  outcry  against  Carnivore  has 
escalated,  some  prominent  figures  in  the 
Internet  industry  have  expressed  a  some¬ 
what  more  sympathetic  view  towaid  the 
FBL  Vint  Cerf,  who  has  been  dubbed  the 
"father  of  the  Internet"  for  his  develop¬ 


ment  of  the  early  technical  foundations  of 
the  network,  said  it  is  "understandable 
that  law-enforcement  agencies  feel 
pressed  to  develop  methods  to  observe  Iri¬ 
ses  traffic  for  the  same  reasons  they 
have  felt  compelled  fo  find  ways  to  listen 
to  certain  telephone  conversations* “ 

a-matl  message* 
added  that  such  modern  surveillance  tech¬ 
niques  need  to  be  balanced  "against  poten¬ 
tially  abusive  practices  that  could  seri¬ 
ously  erode  personal  privacy" 

-Nett  King  Jn 
contributed  to  this  article. 

Coca-Cola  FUes  to  Have 
Second  Race-Bias  Suit 
Moved  to  Federal  Court 

By  a  Waix  Street  Journal  Staff  Reporter 

ATLANTA — Coca-Cola  Co.,  in  the  pro¬ 
cess  of  settling  a  class-action  race-discrim¬ 
ination  lawsuit,  has  filed  a  motion  to  move 
a  second,  $1,5  billion  race-bias  suit  to  fed¬ 
eral  from  state  court 
The  soft-drfnXeompsDyaitued  in  a  mo¬ 
tion  hied  Friday  that  most  of  the  claims  in 
the  lawsuit,  filed  last  month  on  behalf  of 
four  female  black  Coke  employees  by 
Willie  S.  Gary  and  Johnnie  Cochran,  in- 
'  volve  federal  laws. 

But  a  Sawyer  on  Mr,  Gary’s  team,  Tri- 
da  CX  Hoffler,  disagreed  and  said  Mr. 
Gary  would  file  a  motion  this  week  fo  keep 
the  cise  in  state  court.  Mr.  Gary,  a  per- 
aortal-injury  attorney,  generally  brings  his 
cases  to  state  courts  and  has  said  he  pre¬ 
fers  that  venue. 

The  lawsuit  filed  by  Mr.  Gary  claims  a 
variety  of  form  of  discrimination,  includ¬ 
ing  negligent  hiring,  intentional  inSietion 
of  emotional  harm  and  hostile  work  envi¬ 
ronment,  Coke  has  called  Mr.  Gary  an  op- 
portnnlsf  and  denied  the  charges. 
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The  Clinton  administration  yes* 
today  called  tor  updating  wiretap 
ping  laws  to  extend  the  powers  of 
law  agreement  to  the  online  world 
while  providing  new  legal  protec* 
lions  for  electronic  communication , 

Administration  officials  also  an* 
oouneed,  as  expedted,  a  plan  to  loos* 
era  controls  on  the  export  of  encrypt 
tlon  aoftwam— the  programs  that 
help  Internet  users  scramble  mes- 
sages  and  data  to  protect  them  horn 
prying  eyes. 

On  the  wiretapping  issue.  White 
House  chief  of  staff  John  0.  Pode- 
sta,  in  a  speech  at  the  National  Press 
Club,  described  the  coming  legisla¬ 
tive  package  as  seeking  to  eliminate 
confusion  about  the  level  of  legal 
protection  for  various  forms  of  com¬ 
munication. 

Telephone  conversations  get  fair¬ 
ly  strong, protection  tom  federal ; 
wiretaps  under  the  1968  Crime  Pa¬ 
trol  and  Safe  Streets  Act  which  re¬ 
quired  a  court  order  and  high-level 
Justice  Department  approval  Wire* 
tape  rules  for  e-mail  sent  by  dial-up 
modem  are  covered  by  the  Electron¬ 
ic  Communications  Privacy  Act-  of 
1986,  That  law  might  not  cover  e* 
mail  sent  by  high-speed  cable  mo¬ 
dem,  and  cable  companies  have  ar¬ 
gued  that  their  online  services! 

-  should  be  given  extremely  high  pro* } 

tection  from  government  surveil¬ 
lance  under  the  Cable  Act . 

*lt*s  time  to  update  and  harmo¬ 
nise  our  existing  laws  to  give  all 
forms  of  technology  the  same  legist ; 
lathee  protections  as  our  telephone : 
conversations^  Podesta  said,  , 

lawmakers  said  they  welcome 
the  opportunity  to  work  with  the  ad- 
ministraikin  on  these  issues, Sen. 
Orrin  G.Hatdi  {R-Utah),  who  has 
introduced  an  Internet  privacy  bill 
said:  "It  is  imperative  that  we  bah 
ance  the  interests  of  law  enforce¬ 
ment  with  the  privacy  rights  of  the 


ministration's  proposals  have  some  heartening  qua!  lies 
to  them,  they  are  too  little  and  too  kte  *  with  too  3  ttle 
time  in  tire  legislati  ve  session  to  pass  new  bills.  The  Car¬ 
nivore  system,  Stelnhardt  said,  ^represents  a  gave 


American  people.  We  must  ensure  that  appropriate 
checks  are  in  place  where  the  government  accesses  pri¬ 
vate  communications  of  Americans,'’ 

ftxlest&said  the  bills  making  up  the  package  would  be 
unveiled  within  10  days,  and  that  he  hopes  the  legisla¬ 
tion  can  be  passed  by  the  end  of  the  year. 

Eodesta  also  spoke  about  the  new  surveillance  tech¬ 
nology  known  as  Carnivore,  wltich  gives  law  enforce* 
ment  authorities  the  ability  to  selectively  monitor  the 
Internet  traffic  of  individuals,  similar  to  the  devices  that 
can  record  the  telephone  numbers  of  calk  made  and  re¬ 
ceived  by  a  suspect.  Unlike  M-Oedged  wiretaps,  Hie  in¬ 
dicia]  oversight  of  such  surveillance  is  slight,  and  the 
protection  against  abuses  of  the  technology  by  law  en¬ 
forcement  is  weak.  Fodesta  called  for  greater  judicial 
oversight 

lire  Fodesta  speech  was  not  well  received  by  dv H  lib¬ 
erties  advocates,  who  have  fought  Carnivore  and  other . 
administration  attempts  to  expand  wiretapping  capabil¬ 
ities  on  the  Internet  Barry  Stemhardt*  associate  direc¬ 
tor  of  the  American  Civil  Liberties  Union,  called  the 
speech  "deeply  disappointing. , . .  While  the  Clinton  ad- 


.  -  - - —  en¬ 

forcement  agencies  unsupervised  access  to  a  nearly  un¬ 
limited  amount  of  commumcations  traffic* 

Podesta  also  discussed  the  new  encryption  pc  icy, 
which  the  administration  can  implement  immedia  tly 
Under  the  plan,  US -  companies  will  be  able  to  expor  .m- 
.  pMsticated  cryptography  products  to  users  in  any  na- 
Hon  in  the  European  Union  and  to  Australia,  Nor  ray, 
the  Czech  Republic,  Hungary,  Poland,  Japan,  New  fen- 
tand’and  Switzerland  The  government  will  ellmi  mte 
Hie  statutory  SOday  waiting  period  before  such  exp  )rts 
can  tajee  bTace  but  will  keep  in  place  a  requirement  hat 
new  technologies  he  submltfed.to  the  government  fir  a 
technical  review. 

Encryption  has  been  a  high-tech  battlefield  bad  the . 
early  days  of  the  Clinton  administration.  Bew  tedu  lo¬ 
gics  are  as  important  In  the  fight  to  maintain  pers  mal 
and  business  privacy,  but  few  technologies  present  i  ueb 
daunting  issues  for  law  enforcement  offidals  like  FB  Di¬ 
rector  Louis  jf.  Freeh,  who  often  wanes  that  crimi  lals 
and  terrorists  can  use  “crypto*  to  cloak  their  plans  and 
activities.  High-tech  companies  successfully  argued  hat 
Uih  restrictions  harmed  only  American  compaj  lies* 
since  overaeasj&ins  ymt  successfully  marketings!]  mg 
encryption  produds;  and  iri  January  the  Clinton  ad  elm 
istratlon  reduced  controls  on  encryption  exports, 

“The  reducing  of  these  regulations  will  certain!  r  al¬ 
low  US,  software  makers  to  compete  in  the  global :  aar- 
ketplaee,*  md  Robert  HoHeyman,  the  chief  exeeutlfe  of 
the  Business  Software  Alliance, 
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By  Billies  UKJtKmviTX 

On  Monday  the  White  House  proposed 
new  legislation  regulating  surveillance  by 
law  enforcement  agencies  on  the  Internet 
Sut civil  libertarians  are  already  complain- 
lag  that  this  plan  does  little  to  address  the 
problems  ostensibly  raised  by  Carnivore, 
the  FBI's  new  software  system  for  perform¬ 
ing  comt^rdered  wiretaps  at  Internet  ser¬ 
vice  providers  (ISPS). 

Using  a  laptop  computer,  law  enforce¬ 
ment  officials  can  hook  Carnivore  into  an 
ISP's  network.  Once  Installed*  it  reads  the 
headers  of  each  e-mail  message —listing 
the  sender*  recipient  and  subject  of  the 
mes$age-as  it  passes  through.  If  the 
sender  or  recipient  is  the  target  of  a  tap. 
Carnivore  records  the  message. 

Rights  at  Risk? 

Here's  the  rub:  Before  Carnivore  can 
know  whether  *  message  belongs  to  a  tar¬ 
geted  party,  it  must  browse  the  headers  of 
all  the  messages  passing  through  the  JSR 
With  a  traditional  phone  tap,  law  enforce' 
meat  officers  only  listened  to  the  tele¬ 
phone  line  that  the  subject  of  the  tap  was 
using.  The  ACLU  and  other  critics  com¬ 
plain  that  when  Carnivore  reads  the  head' 
ers  of  anyone  who  Is  not  a  target  it  vfo- 
dates  their  rights. 

|  The  ACLU-  and  other  Carnivore  critics 
noted  to  get  a  grip-and  a  batter  under¬ 
standing  of  the  new  technology. 

L  Unlike  old-fashioned  analog  telephone 
pBs,  e-mail  messages  are  transmitted  dig- 
Maliy.  A  computer  slices  and  dices  the  mes¬ 
sage  Into  packets,  each  with  an  identify- 
m  tag*  .  The  packets  then  spread  out 
throughout  the  Internet,  finding  the  most 
dpcient  path  to  the  destination  When 
they  arrive,  they  are  reassembled,  and  the 
Hic&ient  gets  the  message.  As  a  result, 
wm  e-mail;  you  cannot  *tap  a  Mae*  be* 
amoMm  there  is,  Uteblly,  no  parheu- 
you  can  do  is  scan  the 

p^ils.  known  to  use-iike.  his  ISP-and 
to at  belong  to  him, 
Snai^witat  Carnivore  does. 

that  using  a  com- 
system  would  cob 
‘Ite  of  - innocent  data.  But 
teds  to  use~a 
^nbaaisT2pfe  to  F8T 
ton*;  and 


These  kinds  of  flaps  are  happening 
more  and  more  often.  Uist  April  some  pri¬ 
vacy  advocates  complained  when  the  FBI 
requested  SIS  million  for  "Digital  Storm." 
a  program  for  monitoring  telephone  calls 
and  analyzing  recordings.  In  September,  a 
programmer  in  North  Carolina  found  the 
notation  "NSA  Key”  in  a  Microsoft  soft¬ 
ware  patch.  Soon  rumors  bounced  through 
the  Internet  claiming  Windows  had  a  back 
door  that  allows  the  National  Security 
Aaency  to  monitor  your  computer,  (Mi¬ 
crosoft  explained  that  the  tag  merely  signi¬ 
fied  that  the  .software  complied  with  the 
agency's  security  standards,) 

The  granddaddy  of  all  bogus  fears, 
though,  is  Echelon,  If  you  believe  some 
European  Union  parliamentarians,  the 
United  States  and  Britain  operate  an  inter¬ 
national  network  that  monitors  virtually  . 
,  ail  communications,  and  extracts  choice  f 
:  nuggets  with  powerful  computers  that  rec¬ 
ognize  key  phrases  in  .messages  like  *as- 
\  sasrinatfon,*  “terrorist  attack”  or  wmdus- 
j  trial  secret,” 

\  In  reality,  it's  not  easy  to  find  a  specific 
1  message  in  a  flood (  of  free-flowing  digihd  i 
:  data*  Thafs  the  whole  reason  for  getting  a  i 
|  court  order  for  a  wire  tap.  If  you  cannot  I 
I  hook  mw an  ISP,  you  have  to  dojkMiS 
searching  to  find  the  message  you  want  to 
Intercept, 

That  is  also  why  the  European  cam¬ 
paign  against  Echelon  is  so  quixotic.  True, 
the  folks  at  NSA  intercept  communications 
and  they  have  powerful  computers  and  in¬ 
genious  software  that  helps  with  the  pro¬ 
cessing.  But  it  is  impossible  for  even  the 
best  computer  system  to  routinely  sort 
through  all  of  the  world's  telecommunica¬ 
tions  and  pull  out  telltale  messages,  as  the 
Echelon  paranoids  would  have  you  be¬ 
lieve. 

Usually  you  need 
to  know  what  you  are 
looking  for  and 
where  the  message 
might  appear  before 
you  have  much  of  a 
chance  of  ffodlngrit 
Also,  the  cases  in 
which  one  message, 
tells  a  .whole  story, 
are  rare.  Good  law 
enforcement  and  in¬ 
telligence  usually^ 
quires  ;  multiple , 
sources  and:  Collat¬ 
eral  Mprinationffo 
.wsM:m's' 

catesipa^gu^. 

'bfcm 


for  our  law  enforce* 
ment  and  mtellh 
gence  organizations 
to  listen  in  on  com- 

o!d  you  com  lapTESer"  ^ 

hf.  lVs  mucti  more  difficult  to 
capture  digital  messages  that  pass  over 
fiber  optics  or  bounce  through  cellular  net- 
works  And.  with  strong  encryption  soft¬ 
ware  freely  available  world-wide  anvone 
really  determined  to  keep  a  message  se- 
cm  can  usually  do  so. 

If  you  have  any  doubts,  just  recall  how 

E  “^nce  smTises  we  h*v« 

tete!y-the  Indian  nuclear  test,  the  North 
Korean  missile  test,  the  terrorist  bomb- 

''^s,°/.An)e™an  tat«ets  to  Mideast 
and  Africa.  Part  of  the  problem  is  that  we 

man>'  0{  sources  that  we 
used  to,  and  everyone  is  getting  better  at 
concealing  their  communications.  i 

So  why  is  it  so  easy  to  stir  up  these 
controversies  about  privacy?  The  simple 
f&ctis  that  relations  between  the  govern* 
ment  and  the  new  Information  industries 
j  are  lousy.  There  is  too  much  suspicion  and 
1  too  little  communication;  '■  > , 

The  administration  gets  part  of  ihe 
blame  for  its  barn-handed  policies,  Canii' 
vore  as  a  good  example.  A  lot  of  contpo- 
yej'sy  could  have  been  defused  If  the  fTBI 
had  offered  more  Insight  into  how  the  sys¬ 
tem  worked  and  bow  the  righto  of  non-sus¬ 
pects  would  be  protected. 

But  the  record  of  the.  technogeeks  has 
not  been  much  better.  They  often  act,  as 
though  law  enforcement  officials  have 'no 
business  poking  into  their  activities  ,kt 
all— as  though  me  could  stop  mternafict&l 
computer  criminals  with  a  good  neighbor¬ 
hood  watch  program. 

IDs  all  too  easy  to  lose  sight  of  the ‘fact 
that  Camivore's-jnain  targets  are  cyljgt:- 
eriminals~m  other  Swords,  the- 
crooks  who  are  a  plague. on  the  Internet 
and  target  dot-com  companies.  Growth 
rates  for  Internet  shopping  have  been  pip¬ 
ping  lately.  According  to  some  experts* 
people  worry  about  whether  their  credit 
card  numbers  and  health  records  are  safe. 
You  would  think  that  e-business  would  $e 
the  tot  to  support  better  |aw  enforcement 
on  the  netv  ,  /  -X  '>* ; ;  •*  u  ■ 

V  ,  •  '  .  ,  V .  vV  '<'  ’a*  (.\*  >  ■.  '-S» 

;;  Cb  itobP;Ooft 
bommoh; 
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reasonable  cooperation  from  the  private 
sector,  and  aggressive  few  enforcement  i 
and  effective  intelligence  closely  moni¬ 
tored  by  responsible  public  officials,  ' 
Fixing  the  relationship  between  Wash¬ 
ington  and  Silicon  Valley  needs  to  be  a  top 
priority  for  the  next  administration.  The 
only  people  be&efittfrsg  from  controversies 
like  the  one  over  Carnivore  are  terrorists, 
criminals  and  rogue  states. 


Mr.  B&rkvwUz  is  a  research  fellow  at'ihe 
Hoover  Institution  m3  coauthor  of  “Best 
Truth:  Intelligence  in  the  Information  Agf 
OWe  University  Press,  BOOOh  / 
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Honorable  Charles  T.  Canady 
Chairman 

Subcommittee  m  the  Constitution 
Committee  on  the  Judiciary 
House  of  Representatives 
Washington,  D,C«  20S15 
/ 

Dear  Mr,  Chairman: 

We  very  much  appreciate  the  opportunity  to  appear  before  the  Constitution 
Subcommittee  on  Monday  to  discuss  "Carnivore.”  The  public  testimony,  we  believe,  will  be 
very  helpful  in  our  efforts  to  explain  what  Carnivore  is  and,  equally  important,  what  it  is  not. 

In  that  regard,  USA  Today  asked  us  to  provide  a  brief  350  w'ord  explanation  for  use 
on  the  editorial  page.  While  a  full  statement  obviously  will  be  provided  to  the  Subcommittee,  we 
would  like  to  share  with  you  the  text  of  what  was  provided  to  the  newspaper.  In  a  very'  concise  fashion, 
it  encapsulates  our  explanation  of  what  the  system  does  electronically  to  ensure  strict  compliance  with 
the  court  orders  that  instruct  us  precisely  what  can  and  cannot  be  intercepted.  I  also  have  enclosed  a 
graphic  that  you  may  find  helpful  . 

As  the  brief  summary  points  out,  Carnivore  is  used  only  when  Internet  Service  Providers 
are  unable  on  their  own  to  restrict  interceptions  wi  thin  the  narrow  confines  of  the  controlling  court  order. 
In  addition,  no  interception  can  occur  unless  the  FBI  or  other  law'  enforcement  agency  can  demonstrate  to 
a  judge's  satisfaction  that  the  strict  statutory  requirements  have  been  met’  e.g.,  that  there  is  probable 
cause  that  a  crime  is  being  or  has  been  committed,  that  the  intercepted  e-mails  will  be  in  furtherance  or 
about  that  crime,  and  that  the  interceptions  are  necessary  to  collect  evidence  of  that  crime.  That  is  why 
its  use  has  been  very  limited,  predominately  to  intercept  e-mails  in  terrorism  cases. 

I  hope  you  find  this  helpful.  Again,  we  look  forward  to  testifying  and,  in  the  interim,  if 
you  have  any  questions,  please  do  not  hesitate  to  ask.  We  would  be  pleased  to  brief  on  any  aspect  of  this 
system. 


Sincerely  yours. 


John  E.  Collingwood 
Assistant  Director 
Office  of  Public  and 
Congressional  Affairs 


1  -  Mr.  Pickard  -  Rm  7142 
1  *  Mr.  Alba  -  Rm  7128 
1  -  Mr.  Gallagher  -  Rm  7110 
1  -  Mr.  Garcia  -  Rm  7116 

u-i 

bic  'I 


j_-  Dr.  Kerr  -  Rm  3090 
T'yMr,  Parkinson  -  Rm  7427 


JEC:mmc 


1  -  Mr.  Coliingwood 

ifldk 

1  -  CA^fi^opy 


i,C-f 

6?C-t 


IDENTICAL  LETTERS  SENT  TO  ALL 
ADDRESSES  ON  ATTACHED  LIST 
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Honorable  Charles  T*  Canady 


Honorable  Henry  J.  Hyde 
House  of  Representatives 
Washington*  D,C,  20515 

Honorable  Asa  Hutchinson 
House  of  Representatives 
Washington,  RC  205  5  5 

Honorable  Spencer  Bachus 
House  of  Representatives 
Washington,  RC  20515 

Honorable  Robert  W.  Goodlatte 
House  of  Representatives 
Washington,  D,C  20515 

Honorable  Bob  Barr 
House  of  Representatives 
Washington,  D  C-  20515 

Honorable  William  L.  Jenkins 
House  of  Representatives 
Washington,  RC  20515 

Honorable  Lindsey  Graham 
House  of  Representatives 
Washington,  RC  20515 

Honorable  Melvin  L.  Watt 
House  of  Representatives 
Washington,  DC  20515 


Honorable  Maxine  Waters 
House  of  Representatives 
Washington,  DC,  20515 


2 


5/24/02  Release  *  Page  It 


Honorable  Charles  T,  Canady 

Honorable  Barney  Frank 
House  of  Representati  ves 
Washington,  D,C  20515 

Honorable  John  Conyers,  Jr, 
House  of  Representatives 
Washington,  B.C  20515 

Honorable  Jerrold  Nadler 
House  of  Representatives 
Washington,  D.C.  20515 
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First,  lets  get  the  facts  straight.  The. FBI  and  all 

f 

t 

other  law  enforcement  agencies' can  only  intercept  e-mails 
pursuant  to  a  court  order  signed  by  a  judge  who  is  satisfied  that 
the  government  has  demonstrated  probable  cause  that  a  serious 
crime  is  being  or  has  been  committed,  the  e-mails  will  be  about 
that  crime  and  the  interception  is  necessary  to  obtain  evidence 
about  the  crime.  To  conduct  an  intercept  beyond  that  is  a 
federal  crime  subject  to  severe  criminal  and  civil  sanctions. 

The  entire  process  x'equires  continual  reporting  to  a  court  and, 
of  course,  ultimately  is  subject  to  vigorous  challenge  by  defense 
attorneys . 


What  does  "carnivore”  do?  In  the  simplest  terms,  it 
ensures  that  only  the  exact  communications  authorised  by  the 
court  to  be  intercepted  are  what  is  intercepted.  So,  for 
example,  if  a  court  authorizes  only  the  interception  of  e-mail 
from  a  particular  drug  dealer  to  another  drug  dealer,  this  system 
captures  only  that  e-mail  to  the  exclusion  of  all  other  computer 
communications  regardless  of  who  sends  them  and  where  they  are 
going.  Nothing  else  is  monitored  or  collected,  and  everything 
collected  is  supervised  by  the  court.  It  would  be  a  federal 
crime  to  do  otherwise. 


5/24/02  Release  -  Pag* 


13 


0 


When  is  carnivore  used?  It  is  used  only  when  an 

Internet  service  provider  cannot ,  on  its  own ,  effect  the 

interceptions  consistent  with  a  narrow  court  order.  Accordingly, 

it  has  been  used  very  tew  times,  predominately  to  intercept 

e-mails  in  terrorism  cases  and,  again,  subject  to  the  supervision 

of  a  court, 

* 

In  1968,  Congress  spelled  out  strict  requirements  for 
the  interception  of  communications ,  Carnivore  simply  ensures 
that  law  enforcement  complies  precisely  with  those  requirements 
as  technology  advances.  We  understand  why  certain  segments 
oppose  this  court  ordered  technique.  But  since  1968,  because  of 
this  law,  many  lives  have  been  saved  and  thousands  of  drug 
dealer's,  terrorists,  child  predators  and  spies  are  in  jail. 

The  Chairman  of  PSINet  laid  out  the  appropriate 
challenge.  He  does  not  want  to  see  carnivore  on  his  network 
unless  we  can  prove  it  sifts  out  only  the  traffic  from  the  target 
of  a  coux't  order.  That,  of  course,  is  precisely  what  carnivore 
does,  electronically  protecting  the  privacy  of  those  not  subject 
to  the  court  order. 
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Carnivore  E-Mail  Tool  Won’t  Eat  Un  Privnr 

Jt&tsi.-  sr£-°r“*  _ r  • 

iafftcttmnm  ofTiie  Wall  Smmr  Jofjww.  CT0U<-  Cin-mwi™  t0.k"OW  h0W  ¥ora'  O  y-t  ^ 

WASHINGTON -Packed  m  a  slim  lap-  TlnM  ^53'  Cm,U  ”m  U(lY^  tiff  T 

>P  computer,  the  Federal  Bureau  of  loves-  JL* ff\municat|ons  from  umo-  ^  ?  O  /  jQ  / 

rattan's  Internet  survpfHanr*  eeot  users?  How  frequently  is  it  used,  and  ^ 


By  Tk»  {Hums 
And  Neil  Kmc;  Jr.  v 

Reporters  «/  Tjic  Wall  Smisttr  Jtswtwii. 

WASHINGTON-Packed  in  a  slim  lap¬ 
top  computer,  the  Federal  Bureau  of  Inves¬ 
tigation’s  Internet  surveillance  system. 
Carnivore,  looks  downright  docile.  One  of 
its  creators  calls  it  merely  a  "tool  in  a  tool 
box"  for  tracking  hackers  and  terrorists. 
Us  name,  the  FBI  admits,  is  unfortunate. 
It  is  too  late  to  change  the  name-hut 
not  too  late,  the  FBI  figures,  to  try  to 
change  the -opinions  of  privacy  advocates 
*and  lawmakers  who  have  spoken  harshly 
of  the  high-tech  sniffer.  So  the  agency  has 
launched  an  Intense,  behind-the-scenes 
campaign  to  deflect  congressional  skepti¬ 
cism  and  convince  wary  Internet  eompt- 
lies  that  Carnivore  is  a  much  pickier  eater 
than  its  critics  claim, 

;  Since  news  of  Carnivore  broke  last 
week,  FBI  officials  have  swarmed  Capitol 
Mil  to.  demonstrate  the  system  to  key 
^embers  of  Congress  and  their  staff.  The 
ofBdals  also  have  shown  it  to  mo  federal 
♦judges  and  a  small  group  of  reporters  for 
fee  Wall  Street  Journal,  And  Tuesday,  the 
published  a  lengthy  article  about  Qar- 
ipyorc  m  its ’Web  site,  describing  itm  a 
^diagnostic  tool”  that  employs  new  tech- 
Mm  *h>  lawfully  obtain  important  infer- 
fniahon  while  providing  enhanced  privacy 
‘  junction/ 

The  message:  Carnivore  is  a  surgical 
":||w-enforcement  device  used  rarely  and 
My  uR&or  strict  court  orders.  And,  con- 
imxy  to  fears  espoused  publicly  in  recent 
Jays,  the  system  doesn't  gobble  up  ail 
passing  e-mail  in  its  search  for  the  corre- 
.^wsdence  of  a  single  suspect.  "This  de- 
*  nee  is  blind  to  everything  but  the  packet 
Jpf  information]  that  it's  set  to  retrieve/ 
Jays  Thomas  Motta*  an  assistant  general 
Jounsel  for  the  mi  *IV$  like  a  cop  who 
see  anything  but  a  blue  car  on  a 
'highway/ 

**••*  fn  advance  of  a  hastily  called  congres- 
jlonai  hearing  next  week,  FBI  officials 
mo  have  been  expressing  regrets  about 
*the  system's  name.  Carnivore  was  the  in- 
Jouse  moniker  given  to  the  successor  of  an 
ferlier  surveillance  system,  which  was 
%lled  Omnivore,  No  one  thought  the  name 
;jduld  become  public.  When  it  did  last 
w^k.  Attorney  General  Janet  Reno  called 
M  4  mm*  change,  and  FBI  Director 
J  Wis  Freeh  started  asking  how  the  bu- 
Jfeu  could  have  had  such  a  tin  ear* 

/  *  ’'Let’s  just  say,  we're  going  .to  put 
inames  through  the  giggle-tests  IRtie  difs 
‘Terentiy  in  the  future/  says  Donald  Kerr* 
director  of  the  special  Quantieo;  Va,,  lab 
that  developed  cimivore/  j:  "'  : 


Si 


rn<ing  more  than  merely  cosmetic  charts 
Lawmakers  are  eager  to  know  how  vora- 
cious  Carnivore  could  get.  Cart  it  vacuum 
up  internet  communicattons  from  inno- 
ceat  users?  How  frequently  is  it  used,  and 
under  what  legal  basis?  Is  Carnivore 
hooked  permanently  into  the  country's  In- 

The  Workings  of  Carnivore 

* 

Ail  data  flows  through  the  Internet,  \ 

##41  ^feeiTwf^« 


m  m  nr w  w  t  ml  m  w  nr  nr  js&  W  M,  m  w  *f*JkW*f*Mi 

A+#_#.M+A  *A+XHb#«  A+#  aX*  A  AHhX+ 
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'  internet  Service  Provider  traffic 
the  FBI  is  tapping  flows  through 
the  Carnivore  filter. 


'  Alt  other  data,  plus  the 
Q  otigml  data  matching  the 
fitter,  flows  onward.  ■*, 


m 


~¥a+x  ±  m  «a+*  »  xjhl 

Carnivore  ISP  Client  s 

Filter  '  '•  '  ■  •'«  •  -■  -  A 


©  .•// 

Copy  of  the  v/ 
requested  dais 
goes  to  Carnivore's 
hard  drive.  v 


'  --.if-  -i *  /«/ '<■  -  , 

Carnivore's 
Hard  Drive 


m 


,  •fee  FBI  / qtrteyos 
ind  analyzes 
captured  data. 


ternet  service  providers?  How  can  we 
trust  that  it  does  only  what  the  FBI  says? 

Protecting  Citizens 

"We  want  to  hear  exactly  haw  this  sys¬ 
tem  works  and  make  sure  it  raises  no  con¬ 
stitutional  problems,”  say's  Rep,  Charles 
Canady,  the  Florida  Republican  who 
heads  the  House  judiciary  subcommittee 
that  will  question  FBI  officials  next  week. 
Adds  Rep.  Asa  Hutchinson*  an  Arkansas 
Republican  and  member  of  the  same 
panel:  “We  have  to  protect  citizens  from 
inadvertent  action  as  well  as  snooping  bv 
the  government/ 

The  system  is  designed  to  allow  the 
FBI  to  conduct  efficient  wiretaps  of  e-mail 
conversations  and  other  online  communi¬ 
cations  involving  suspected  hackers,  ter¬ 
rorists  and  ether  criminals,  Hie  fear 
among  critics  is  that  Carnivore  will  scoop 
up  transmissions  made  between  innocent 
civilians  And  lay  them  open  to  scrutiny, 

Internet  providers,  such  as  Rtmaifet 
of  New  Haven,'  Conn.,  say  Carnivore  Is 
unnecessary  because  they  already  can  do 


the  monitoring  the  Ml  seeds  if  ordered  by 
a  court,  "We're  able  to  .do  it  faster*  more 
efficiently  and*  most  importantly*  without 
intruding  on  the  privacy  of  people  not 
within  the  scope  of  the  search/  says  Peter 
William  Sachs*  president  of  femmNet* 
who  is  scheduled  to  testify  at  next  w^eek's 
hearing*  Ea rtbJJakThc*,  one  of  fee  na- 
f'  hon^  largest  Memet:-service  providers, 

;  says  R  efused  eariier  this  year  to  install 
:  Carnivore  on  Sts  network,  claiming  teefud- 
vcal  adjustments  reqnired^ ^IplJSe  the  devled 


In  its  meetings  with  lawmakers  and  oth¬ 
ers*  the  FBI  has  described  the  inner  work¬ 
ings  of  the  system  in  unusual  detail.  In 
one  demonstration  this  week*  the  agency 
was  keen  to  show  how  the  system  could 
tailor  its  search  so  it  captures  only  the 
e-mails  moving  into  and  out  of  one  particu¬ 
lar  account  The  FBI  said  Carnivore  is 
smart  enough  to  capture  :  a  suspect's 
e-mails  while  tearing  untouched  messages 
sent  by  his  or  her  spouse  or  children. 
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•The  system  belongs  to  a  class  of  tools 
Known  ns  “packet  fitters"  or  “sniffers*1* 
which  look  for  parcels  of  data  that  travel 
across  a  network  and  comprise  an  e-mail 
or  a  visit  to  a  Web  site.  Using:  a  Windows 
screen*  Carnivore  also  can  be  set  to  cap¬ 
ture  file  downloads  and  chat-room  conver¬ 
sations.  It  c tm  grab  e-mail  from  the  most 
popular  Web-based  companies*  including 
Yahoo!  Inc*  and  Microsoft  Corp.'s  Hot¬ 
mail.  And  once  it  is  installed  at  an  titter- 
net  service  provider,  the  FBI  can  dial  into 
Carnivore  to  make  changes  and  monitor 
data  that  have  been  collected. 

The  FBI  is  adamant  about  dispelling 
fears  that  Carni  vore  could  be  used  for  ram¬ 
pant  tapping  of  public  e-mail  systems.  For 
one*  wiretapping  requests  are  closely  scru¬ 
tinized  by  the' Justice  Department*  and 
must  be  approved  by  a  federal  judge. 
Abuse  by  a  rogue  Investigator  is  even  less 
likely*  the  bureau  says*  because  the  rogue 
would  need  too  much  cooperation  from 
other  FBI  techies  and  the  Internet  service 
provider,  says  Marcus  Thomas*  a  devel¬ 
oper  of  the  system  at  Quantleo. 


U  caiSilJf  r  *  M**  instructions, 
■  wnwre  am  be  set  to  merely  trace  feter- 

to  and  fr°m  *  »*• 

raw  nfit  pen  re{rts!er‘' or  “trap  and 
*»»•  aouvwe  records  the  Internet  ad- 

f™«PS.fpassinir  traffic  hut  not,  for  ex- 

liS’.(he  C0Rten!s  or  «v«t  fhe  subject 

nntton»ith>aiLwSlRCe  lhe  8motm{  of  iflfor- 
matton  gathered  is  relatively  small  in 

these  instances,  even  a  week's  worth  of 

floim-tof  if”  ^  Sl0r8d  0fl  a  Single 
*  k‘  he  a<:eRC>  sa-vs-  With  judicial 
permission,  the  system  also  can  conduct 
fuller  intercepts,  which  would  gather  the 
contents  of  the  e-mails  and  other  data, 
ii-  r-Ifc  sa^s  Carnivore  doesn’t  mom- 

bi!itv«fwfenf  Cf  passing  e-raaiis.  a  capa- 
?mored  to  «*i*t  *n  the  contro- 
erated  M "surveillance  network  op- 
emed  overseas  by  the  National  Security 

0f!icia,s  sald  watching  for 
hey  words  in  passing  e-mails  was  techni- 
caily  possible,  but  that  it  would  slow  inter- 
net  traffic  unacceptably  for  all  customers 

art»«ihftt6f!f£  Ulfh  s  ®ac!iine  like  this  to 
actually  read  everything  that  goes  by,  you 

mas  gf*  C3rm°t  d6ai  a"  Mr>  Tho- 

vo^n  S-r^  SSLS  H  has  use«J  Carni- 
25  investigations  over 

'  raos!  {ar?et®g  sus¬ 
pected  terrorists  or  computer  hackers.  In 

each  case,  the  system  was  connected  to  i 
wn_eri.  it  intercepted  data  or  e-mails  in 
^np!,af!CC  *1!h  a  court  order’  th«- 

nriw  adS*ates>  wil<>  haven't  been 
pnvy  to  the  FBI  tiemonstratitos.  hunver 

tortcanoSfr  hi^'  e^ia83tio»s-  The  ' 
American  Cmi  Liberties  Union  wants  the 

FBI  to  suspend  Carnivore's  use,  arguing 
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From: 

To: 

Date: 

Subject: 

Gentlemen: 


7/20/00  4:38PM 
OOJ  review  of  statement. 


6&-t 

DONALD  KERR,  LARRY  PARKINSON, 


Upon  giving  the  *8naP  draft  of  Dr,  Kerfs  statement  to  OPCA  i  was  informed  that  nn  * 

our  final  version  of  the  statemenl  before  OPOfl  disseminates'  it  to  »e  Safe  nM8w 

c°  mnt  fIuSS'v Sn StaSSSfZ  S/T*  'he  "'ere,om  ™  ”*»  «» 

comments  tXe  ^easin^  £* t?  Ore?  “  “  D0J  reKOT"»“‘’«  «*  W  ™view  and 

'  wal^KS^SSTtSIcPA0'  25,1  5el  ,te  <* 


ii 

i  7 C -I 


5/24/02  Release -P4 


L 


~>c. 


From: 

To: 

Date: 

Subject: 


1 


:20PM 
Don  Kerfs  Testimony 


lie.-} 


SferenSbSvlSn t S-KJrt  i?Clude a  f)X for the  Pmb!em ihat  we i«st discussed,  namefy  the 
betweenJ;til  s  standards  for  interception  of  orai/wire  communications  and  those  for  elertmnt 
communications.  The  former  are  set  forth  in  18  USC  2518(1),  the  fatter  in  18  USC  2518(3). 

For  the  purpose  of  this  testimony,  the  two  main  differences  are: 

(1 )  that  applications  under  2516(3)  do  not  require*  senior  level  DOJ  approval  and  f2>  that  thf*v  nnt 
limited  to  certain  federal  felonies.  Thus  if  we  strike  the  sentence  at  the  bottom  of  oaae  tworton  nf  nan 

n/nL5fhrrnw°rtaKth0rifation  by  a  senior  0fficial  of  D0J)  and  the  last  sentence  in  the  first  pai-aoS 
page  three  ("Further,  interception  of  communications  is  limited  to  certain  specified  felony  offenses"! 

m¥£Min9  mm?*s  8$  »  wni°h  > 
use  28l6{1)?lSer  thS  25l8fJ  nrr  th  mfJ  Tf instances  where  «»  testimony  suggests  that  we 

016(1}  rather  than  2518(3),  OGC  should  scrub  the  testimony  again  to  check  for  such  instances. 


CHARLES  STEELE 


4,6-f 

2  ?c  -/ 
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STATEMENT  OF 


KEVIN  V,  Di  GREGORY 
DEPUTY  ASSISTANT  ATTORNEY  GENERAL 
UNITED  STATES  DEPARTMENT  OF  JUSTICE 
BEFORE  THE  SUBCOMMITTEE  ON  THE  CONSTITUTION 
OF  THE  HOUSE  COMMITTEE  ON  THE  JUDICIARY 
'  on 

“CARNWORE’*  AND  THE  FOURTH  AMENDMENT 

July  24, 2000 

Mr.  Chairman  and  Members  of  the  Subcommittee,  thank  you  for  allowing  me  this 
opportunity  to  testify  abouuhe  law  enforcement  tool  "Carnivore"  and  the  Fourth  Amendment. 
On  April  6, 2000, 1  had  the  privilege  of  testifying  before  you  during  a  hearing  on  Internet  privacy 
and  the  Fourth  Amendment;  1  am  pleased  to  continue  to  participate  in  the  discussion  today  about 
Carnivore”  and  its  role  In  protecting  individual  privacy  on  the  Internet  from  unwarranted 
governmental  intrusion,  and  about  the  critical  role  die  Department  plays  to  ensure  that  the 
Internet  is  a  safe  and  secure  place.  * 

Briyacy  and  Public  Safety 

It  is  beyond  dispute  that  the  Fourth  Amendment  protects  the  rights  of  Americans  while 
they  work  and  play  on  the  Internet  just  as  it  does  in  the  physical  world.  The  goal  is  a  long- 
honored  and  noble  one:  to  preserve  our  pri  vacy  while  protecting  the  safety  of  our  ci  tizens.  Our 
founding  fathers  recognized  that  in  order  for  our  democratic  society  to  remain  safe  and  our 
liberty'  intact,  law  enforcement  must  have  the  ability  to  investigate,  apprehend  and  prosecute 
people  for  criminal  conduct.  At  the  same  time,  however,  our  founding  fathers  held  in  disdain  the 
government’s  disregard  and  abuse  of  privacy  in  England.  The  founders  of  this  nation  adopted  the 
Fourth  Amendment  to  address  the  tension  that  can  at  rimes  arise  between  privacy  and  public 
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safety.  Under  the  Fourth  Amendment,  the  government  must  demonstrate  probable  cause  before 
obtaining  a  warrant  for  a  search,  arrest,  or  other  significant  intrusion  on  privacy. 

Congress  and  the  courts  have  also  recognized  that  lesser  intrusions  on  privacy  should  be 
permitted  under  a  less  exacting  threshold.  The  Electronic  Communications  Privacy  Act 
(  ECPA  }  establishes  a  three-tier  system  by  which  the  government  can  obtain  stored  information 
Irom  electronic  communication  service  providers.  In  general,  the  government  needs  a  search 
warrant  to  obtain  the  content  of  unretrieved  communications  (like  e-mail),  a  court  order  to  obtain 
transactional  records,  and  a  subpoena  to  obtain  information  identifying  the  subscriber.  See  58 
U.S.C.  §§  2701-11. 

In  addition,  in  order  to  obtain  source  aid  destination  information  in  real  time,  the 
government  must  obtain  a  “trap  and  trace”  or  “pen  registeri’  court  order  authorizing  the  recording 
of  such  information.  See  IS  U.S.C.  1821  et.  Seq. 

Because  of  the  privacy  values  it  protects,  the  wiretap  statute,  1  S'U-S.C.  §§251 0-22, 
commonly  known  as  Title  113,  places  a  higher  burden  on  the  real-time  interception  of  oral,  wire 
and  electronic  communications  than  the  Fourth  Amendment  requires,  hr  the  absence  of  a 
statutory  exception,  the  government  needs  a  court  order  to  wiretap  communications.  To  obtain 
such  an  order,  the  government  must  show  that  normal  investigative  techniques  for  obtaining  the 
information  have  or  are  likely  to  fail  or  are  too  dangerous,  and  that  any  interception  will  be 
conducted  so  as  to  ensure  that  the  intrusion  is  minimized. 

The  safeguards  for  privacy  represented  by  the  Fourth  Amendment  and  statutory 
restrictions  on  government  access  to  information  do  cot  prevent  effective  law  enforcement 
Instead,  they  provide  boundaries  for  law  enforcement  clarifying  what  is  acceptable  evidence 
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gathering  and  what  is  not.  At  the  same  time,  those  who  care  deeply  about  protecting  individual 
privacy  must  also  acknowledge  that  law  enforcement  has  a  critical  role  to  play  in  preserving 
privacy.  When  law  enforcement  investigates,  successfully  apprehends  and  prosecutes  a  criminal 
who  has  stolen  a  citizen’s  personal  information  from  a  computer  system,  for  example  "law 
enforcement  is  undeniably  working  to  protect  privacy  and  deter  further  privacy  violations.  The 
same  is  tree  when  law  enforcement  apprehends  a  hacker  who  compromised  the  financial  records 
of  a  bank  customer. 

As  we  move  into  the  2 1S!  century,  we  must  ensure  that  foe  needs  of  privacy  and  public 
safety  remain  in  balance  and  are  appropriately  reflected  in  tire  new  and  emerging  technologies 
that  are  changing  the  face  of  communications.  Although  the  primary  mission  of  the  Department 
of  Justice  is  law'  enforcement.  Attorney  General  Reno  and  foe  entire  Department  understand  and 
share  the  legitimate  concerns  of  all  Americans  with  regard  to  personal  pri  vacy.  The  Department 
has  been  and  will  remain  committed  to  protecting  the  privacy  rights  of  individuals.  We  look- 

forward  to  working  with  Congress  and  other  concerned  individuals  to  address  these  important 
matters  in  tire  months  ahead. 


Law  En 


Although  foe  Fourth  Amendment  is  over  two  centuries  old,  foe  Internet  as  we  know  it  is 

!>  •  •.  v  .  *  =■  .  . 

sfii!  m  its  infancy.  The  huge  advances  in  the  past  ten  years  have  changed  forever  the  landscape 
of  society,  not  just  in  America,  but  worldwide.  He  internet  has  resulted  in  new  and  exciting 
ways  for  people  to  communicate,  transfer  information,  engage  in  commerce,  and  expand  their 
educational  opportunities.  These  axe  hut  a  few  of  foe  wonderful  benefits  of  this  rapidly  changing  -  - 

technology.  As  has  been  foe  case  with  every  major  technological  advance  in  our  history. 
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however,  we  are  seeing  individuals  and  groups  use  this  technology  to  commit  criminal  acts.  As 
Deputy  Attorney  General  Eric  Holder  told  the  Crime  Subcommittee  of  this  Committee  in 
February,  our  vulnerability  to  computer  crime  is  astonishingly  high  and  threatens  not  only  our 
financial  well-being  and  our  privacy,  but  also  this  nation’s  critical  infrastructure. 

t 

Many  of  the  crimes  that  we  confront  everyday  in  the  physical  world  are  beginning  to 
appear  in  the  online  world.  Crimes  like  threats,  extortion,  fraud,  identity  theft,  and  child 
pornography  are  migrating  to  the  Internet  The  Fourth  Amendment  and  laws  addressing  privacy 
2nd  public  safety  serve  as  a  framework  for  law  enforcement  to  respond  to  this  new  forum  for 


criminal  activity.  If  law  enforcement  fails  properly  to  respect  individual  privacy  in  its 
investigative  techniques,  the  public’s  confidence  in  government  will  be  eroded,  evidence  will  be 
suppressed,  and  criminals  will  dude  successful  prosecution.  If  Saw  enforcement  is  too  timid  in 


responding  to  cybercrime,  however,  we  will,  in  effect,  render  cyberspace  a  safe  haven  for 
entnmais  and  terrorists  to  communicate  and  carry  out  crime,  without  fear  of  authorized 


government  surveillance.  If  we  fall  to  make  the  Internet  safe,  people’s  confidence  in  using  the 
Internet  and  e-commerce  will  decline,  endangering  the  very  benefits  brought  by  the  Information 
Age,  Proper  balance  is  the  key* 


To  satisfy  our  obligations  to  the  public  to  enforce  the  laws  and  preserve  the  safety,  we  use 
the  same  sorts  of  investigatory  techniques  and  methods  online  as  we  do  in  the  physical  world, 
with  fee  same  careful  attention  to  the  strict  constitutional,  statutory,  internal  and  court-ordered 
boundaries.  Carnivore  is  simply  an  investigatory  tool  that  is  used  online  only  under  narrowly 

defined  circumstances,  and  only  when  authorized  by  law,  to  meet  our  responsibilities  to  the 
public. 
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To  illustrate,  law  enforcement  often  needs  to  find  oat  from  whom  a  drug  dealer,  for 
instance,  is  buying  his  illegal  products,  or  to  whom  the  drug  dealer  is  selling.  To  investigate  this 
it  is  helpful  to  determine  who  is  communicating  with  the  drug  dealer.  In  the  ‘'olden  days”  of 
perhaps  10  years  ago,  the  drag  dealer  would  have  communicated  with  his  supplier  and  customers 
exclusively  through  use  of  telephones  and  pagers.  Law  enforcement  would  obtain  an  order  from 
a  court  authorizing  the  installation  of  a  “trap  and  trace”  and  a  "pen  register”  device  on  the  drug 
dealer's  phone  or  pager,  and  either  the  telephone  company  or  law  enforcement  would  have 
installed  these  devices  to  comply  with  the  court’s  order.  Thereafter,  the  source  and  destination  of 
his  phone  calls  would  have  been  recorded.  This  is  information  that  courts  have  held  is  not 
protected  by  any  reasonable  expectation  of  privacy.  Given  the  personal  nature  of  this 


information,  however,  the  law  requires  government  to  obtain  an  order  under  these  circumstances. 


lit  this  way,  privacy  is  protected  and  law  enforcement  is  able  to  investigate  to  protect  the  public 
Now,  that  same  drag  dealer  may  be  just  as  likely  to  send  an  e-mail' as  call  his 


confederates.  When  law  enforcement  uses  a  "trap  and  trace”  or  “pen  register”  in  the  online 
context,  however,  we  have  found  that,  at  times,  the  Internet  sendee  provider  has  been  unable  or 


even  unwilling  to  supply  tins  information.  Law  enforcement  cannot  abdicate  its  responsibility  to 
protect  public  safety  simply  because  technology  has  changed.  Rather,  the  public  rightfully 
expects  that  law'  enforcement  will  continue  to  be  effective  as  criminal  activity  migrates  to  the 
Internet.  We  cannot  do  this  without  tools  like  Carnivore. 

When  a  criminal  uses  e-mail  to  send  a  kidnaping  demand,  to  buy  and  sell  illegal  drags  or 
to  distribute  child  pornography,  law  enforcement  needs  to  know  to  whom  he  is  sending  messages 


and  from  whom  he  receives  them.  To  get  this  information, 


we  obtain  a  court  order,  which  wc 
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serve  on  fee  appropriate  service  provider.  Because  of  fee  nature  of  Internet  communications,  the 
addressing  information  (which  does  not  include  the  content  of  the  message)  is  often  mixed  in 
wife  a  lot  of  ofeer  non-content  data  that  we  have  no  desire  or  authority  to  gather.  If  fee  service 
provider  can  comply  with  the  order  and  provide  us  wife  only  fee  addressing  information  required 
by  court  order,  it  will  do  so  and  we  will  not  employ  Carnivore.  If,  however,  fee  service  provider 
is  unwilling  or  unable  to  comply  with  the  order,  we  simply  cannot  give  a  criminal  a  free  pass.  It 
is  for  that  narrow  set  of  circumstances  that  fee  FBI  designed  “Carnivore.” 


Carnivore  is,  in  essence,  a  special  filtering  too!  feat  can  gather  fee  information  authorized 


by  court  oroer,  and  only  that  information.  It  permits  law  enforcement,  for  example,  to  gather 


only  the  email  addresses  of  those  persons  wife  whom  the  drug  dealer  is  communicating,  without 
allowing  any  human  being,  either  from  law  enforcement  or  fee  service  provider,  to  view  private 


information  outside  of  the  scope  of  the  court’s  order.  In  ofeer  words.  Carnivore  is  a  minimization 
tool  that  permits  law  enforcement  strictly  to  comply  with  court  orders,  strongly  to  protect 
privacy,  and  effectively  to  enforce  fee  law  to  protect  fee  public  interest  hi  addition.  Carnivore 
creates  an  audit  trail  that  demonstrates  exactly  what  it  is  capturing. 

As  with  any  other  investigative  tools,  there  are  many  mechanisms  we  have  in  place  to 


prevent  against  possible  misuse  of  Carnivore,  and  to  remedy  misuse  feat  has  occurred.  The 
Fourth  Amendment  ,  of  course,  restricts  what  law  enforcement  can  do  wife  Carnivore,  as  do  the 

statutory  requirements  of  Title  SI  and  the  Electronic  Communications  Privacy  Act,  and  the 
courts. 


For  federal  Title  in  applications,  the  Department  of  Justice  imposes  its  own  guidelines  on 
top  of  the  privacy  protections  provided  by  the  Constitution,  statutes  and  fee  courts.  For  example, 
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before  Carnivore  may  be  used  to  intercept  wire  or  electronic  communications,  the  requesting 
investigatory  agency  must  obtain  approval  from  the  Department  of  Justice.  Specifically,  the 
Office  of  Enforcement  Operations  in  the  Criminal  Division  of  the  Department  reviews  each 

*r 

proposed  Title  HI  application  to  ensure  that  the  interception  satisfies  the  Fourth  Amendment 
requirements,  and  is  in  compliance  with  applicable  statutes  and  regulations.  Similarly,  typically 
the  U.S.  Attorney  or  the  section  chief  within  the  Department  who  is  handling  the  investigation 
also  reviews  the  Title  III  intercept  request.  Even  if  the  proposal  clears  the  OEO,  approval  must 
be  given  by  a  Deputy  Assistant  Attorney  General  Although  this  requirement  of  high-level 
review  is  required  by  Title  HI  only  with  regard  to  proposed  intercepts  of  wire  and  oral 
communications,  the  Department  voluntarily  imposes  the  same  level  of  review  for  proposed 
interceptions  of  electronic  communications  (except  digital-display  pagers).  Typically, 
investigative  agencies  such  as  the  Federal  Bureau  of  Investigation  have  similar  internal 
requirements,  separate  and  apart  from  Constitutional,  statutory'  or  Department  of  Justice 
requirements. 

If  the  investigative  agency  and  the  Department  of  Justice  approve  a  federal  Title  HI 
request,  it  still  must,  of  course,  be  approved  by  the  proper  court.  The  court  will  evaluat  e  the 
application  under  the  Fourth  Amendment  and  using  the  familiar  standards  of  Title  HI.  By  statute, 
for  example,  the  application  to  the  court  must  show,  through  sworn  affidavit,  why  the  intercept  is 
necessary  as  opposed  to  other  less-intrusive  investigatory  techniques.  The  application  must  also 
provide  additional  detail,  including  whether  there  have  been  previous  interceptions  of 
communications  of  the  target,  the  identity  of  the  target  (ifkaown),  the  nature  and  location  of  the 
communications  facilities,  and  a  description  of  the  type  of  communications  sought  and  the 
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ofienses  to  which  the  communications  relate.  By  statute  and  internal  Department  regulation,  the 
interception  may  last  no  longer  than  30  days  without  an  extension  fey  the  court. 

Courts  also  often  impose  their  own  requirements.  For  example,  many  federal  courts 
require  that  the  investigators  provide  periodic  reports  setting  forth  information  such  as  the 
number  of  communications  intercepted,  steps  taken  to  minimize  irrelevant  traffic,  and  whether 
the  interceptions  have  been  fruitful.  The  court  may,  of  course  terminate  the  interception  at  any 
time. 

The  remedies  for  violating  Title  331  or  ECFA  by  improperly  intercepting  electronic 
communications  can  include  criminal  sanctions,  civil  suit,  and  for  law  enforcement  agents, 

adverse  employment  action.  For  violations  of  the  Fourth  Amendment,  of  oourse7foe  remedv of 
suppression  is  also  available. 

Carnivore  itself  also  contains  self-regularing  features.  For  example,  because  of  its 
sophisticated  passive  filtering  features,  it  automates  the  process  of  minimization  without 
intrusive  monitoring  by  investigators,  and  simply  disregards  packets  of  information  that  do  not 
satisfy  the  criteria  in  the  court  ’s  authorization.  Indeed,  one  of  the  most  powerful  privacy- 
protecting  features  of  Carnivore  is  its  ability  to  ignore  information  that  is  outside  the  scope  of  foe 
court-ordered  authority.  For  later  verification,  it  also  logs  the  filter  settings.  In  addition,  as  a 
practical  matter,  Carnivore  is  not  deployed  except  with  close  cooperation  with  foe  appropriate 
system  provider.  In  any  event,  the  FBI  does  not  use  Carnivore  in  every  instance  in  which  foe 
court  orders  a  Title  SI  electronic  communication  intercept.  Indeed,  I  understand  that  foe  Bureau 
uses  Carnivore  only  In  those  instances  when  the  sendee  provider  is  unable  to  comply  with  the 
court  order  using  its  own  equipment,  or  when  the  provider  asks  foe  FBI  to  use  Bureau  equipment. 
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As  I  testified  in  April,  we  face  three  major  categories  of  challenges  in  tiding  to  keep  the 
Internet  a  safe  and  secure  place  for  our  citizens.  These  are: 

L  Technical  challenges  that  hamper  law  enforcement's  ability  to  locate  and 
prosecute  criminals  feat  operate  online; 

2.  Certain  substantive  and  procedural  laws  that  have  not  kept  pace  with  the  changing 
technology,  creating  significant  legal  challenges  to  effective  investigation  and 
prosecution  of  crime  in  cyberspace;  and 

3.  Resource  needs  that  must  be  addressed  to  ensure  that  law  enforcement  can  keep 
pace  with  changing  technology  and  has  fee-  ability  to  hire  and  train  people  to  fight 
cybercrime. 

Carnivore  is  an  investigative  tool  that  assists  us  in  meeting  the  first  challenge.  As  we 
have  witnessed,  tracking  a  criminal  online  is  not  always  an  impossible  task  using  our 
investigative  tools.  For  example,  last  year  federal  and  state  law  enforcement  combined  to 
successfully  apprehend  fee  creator  of  the  Melissa  virus  and  the  indi  vidual  who  created  a  ' 
fraudulent  Bloomberg  News  Service  website  in  order  to  artificially  drive  up  the  stock  price  of 
PairGain,  a  telecommunications  company  based  in  California,  Although  we  are  proud  of  these 
important  successes,  we  still  face  significant  challenges  as  online  criminals  become  more  and 
more  sophisticated. 

In  nearly  every  online  case,  tracking  fee  online  criminal  requires  law  enforcement 
to  attempt  to  trace  fee  '‘electronic  trail”  from  the  victim  back  to  the  perpetrator.  In  effect,  this 
electronic  trail  is  fee  fingerprint  of  fee  twenty-first  century  —  only  much  harder  to  find  and  not 
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as  permanent  as  its  more  traditional  predecessor,  fa  the  physical  world,  a  criminal  and  Ms  victim 

If 

are  generally  in  the  same  location.  But  cybercriminals  do  not  have  to  physically  visit  the  crime 
scene.  Instead  they  cloak  their  illegal  activity  by  weaving  communications  through  a  series  of 
anonymous  remailers,  by  creating  forged  e-mail  headers  with  powerful  point  and  click  tools 
readily  downloadable  from  hacker  websites,  by  using  a  “free-trial”  account  or  two,  or  by  “wiping 

clean  the  logging  records  that  would  be  evi  dence  of  their  acti  vity, 

! 

fa  some  cases,  the  criminal  may  not  even  be  in  the  same  country'  as  the  victim.  The  global 


nature  of  the  Internet,  while  one  of  the  greatest  assets  of  theifatemet  to  law-abiding  citizens, 
allows  criminals  to  conduct  their  illegal  activity  from  across  the  globe,  fa  these  cases,  the  need 


to  respond  quickly  and  track  the  criminal  is  increasingly  complicated  and  often  frustrated  by  the 
fact  that  the  activity  takes  place  throughout  different  countries.  With  more  than  190  countries 


connected  to  the  Internet,  it  is  easy  to  understand  the  coordination  challenges  that  face  law 
enforcement.  Furthermore,  in  these  cases,  time  is  of  the  essence  and  die  Victim  may  not  even 


realize  they  have  been  victimized  until  die  criminal  has  long  since  signed-off.  Clearly,  the 
technical  challenges  for  law  enforcement  are  real  and  profound. 


This  fact  was  made  clear  in  the  findings  and 


j 

conclusions  reached  fa  the  recently  released 


report  of  the  President’s  Working  Group  on  Unlawful  Conduct  on  the  Internet,  entitled,  “The 
Electronic  Frontier:  The  Challenge  of  Unlawful  Conduct  favjolvmg  the  Use  of  the  Internet.”  This 
extensive  report  highlights  in  detail  the  significant  challenges  facing  law  enforcement  in 
cyberspace.  As  the  report  states,  the  needs  and  challenges  confronting  law  enforcement,  “are 
neither  trivial  nor  theoretical”  The  Report  outlines  a  three-pronged  approach  for  responding  to 
unlawful  activity  on  the  Internet: 
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Conduct  on  the  Internet  should  be  treated  in  the  same  manner  as  similar  conduct 
offline,  in  a  technology  neutral  manner. 

We  must  recognise  that  the  needs  and  challenges  of  law  enforcement  posed  by  the 
Internet  are  substantial,  including  our  the  need  for  resources,  up-to  date 
investigative  tools  and  enhanced  multi-jurisdictional  cooperation. 

Finally,  continued  support  for  private  sector  leadership  in  developing  tools  and 
methods  to  help  Internet  users  to  prevent  and  minimize  the  risks  of  unlawful 
conduct  online. 


I  would  encourage  anyone  with  an  interest  in  this  important  topic  to  review  carefully  the 

report  of  the  Working  Group.  The  report  can  be  found  on  fee  Internet  by  visiting  the  website  of . . I 

the  Department  of  Justice’s  Computer  Crime  and  Intellectual  Property  Section,  located  at 
^fw^h^rcnme^pv.  In  addition  to  the  report,  www,cvhercrime.gov  also  contains  other  useful 
information  on  a  wide  array  of  Internet  related  issues,  including  the  topioof  today’s  hearing  - 
privacy. 

Despite  the  type  of  difficulties  outlined  in  fee  Unlawful  Conduct  Report  and  discussed 
today,  the  Justice  Department  and  law  enforcement  across  this  nation  are  committed  to 
continuing  to  work  together  and  with  their  counterparts  in  other  countries  to  develop  and 
implement  investigative  strategies  to  successfully  track,  apprehend,  and  prosecute  individuals 
who  conduct  criminal  activity  on  the  Internet,  In  so  doing,  fee  same  privacy  standards  that  apply 
in  fee  physical  world  remain  effective  online. 

Mr.  Chairman,  fee  Department  of  Justice  has  taken  a  proactive  leadership  role  in  making 
cyberspace  safer  for  all  Americans.  The  cornerstone  of  our  cybercrime  prosecutor  program  is  fee 
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Crimmal  Division’s  Computer  Crime  and  intellectual  Property  Section,  known  as  CCIPS. 

COPS  was  founded  in  1991  as  the  Computer  Crime  Unit,  and  became  a  Section  in  1996,  CCIPS 
has  grown  from  five  attorneys  in  1996  to  twenty  today  -  and  we  need  more  to  keep  pace  with  the 
demand  for  their  expertise.  The  attorneys  in  COPS  work  closely  on  computer  crane  cases  wife 
Assistant  United  States  Attorneys  known  as  “Computer  and  Telecommunications  Coordinators,” 
or  CTC’s,  in  U.S.  Attorney’s  Offices  around  fee  nation.  Each  CTC  receives  special  training  and 
equipment  and  serves  as  the  district’s  expert  on  computer  crime  cases.  CCIPS  and  the  CTC’s 
work  together  In  prosecuting  cases,  spearheading  training  for  local,  state  and  federal  law 
enforcement,  working  wife  international  counterparts  to  address  difficult  international 
challenges,  and  providing  legal  and  technical  instruction  to  assist  in  the  protection  of  this 
nation’s  critical  infrastructures.  We  are  very- proud  of  fee  work  these  people  do  and  we  will 
continue  to  work  diligently  to  help  stop  criminals  from  victimizing  people  online. 

I  also  note  that  public  education  is  an  important  component  of  the  Attorney  General’  s 
strategy  on  combating  computer  crime.  As  she  often  notes,  the  same  children  who  recognize  that 
it  is  wrong  to  steal  a  neighbor’s  mail  or  shoplift  do  not  seem  to  understand  feat  it  is  equally 
w  -  ong  to  steal  a  neighbor’s  e-mail  or  copy  a  proprietary  software  or  music  file  without  paying  for 
it  To  remedy  this  problem,  fee  Department  of  Justice,  together  with  the  Information  Technology 
Association  of  America  (JTAA),  has  embarked  upon  a  national  campaign  to  educate  and  raise 
awareness  of  computer  responsibility  and  to  provide  resources  to  empower  concerned  citizens. 

The  “Cybereitizen  Awareness  Program”  seeks  to  engage  children,  young  adults,  and  others  on 
fee  basics  of  critical  information  protection  and  security  and  on  the  limits  of  acceptable  online 
behavior.  The  objectives  of  fee  program  are  to  give  children  an  understanding  of  cyberspace 
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benefits  and  responsibilities,  an  awareness  of  consequences  resulting  from  the  misuse  of  the 
medium  and  an  understanding  of  the  personal  dangers  that  exist  on  the  Internet  and  techaujues  to 
avoid  being  harmed. 

Conclusion: 

/  * 

Mr,  Chairman,  I  want  to  thank  you  again,  for  this  opportunity  to  test?  fy  today  about  our 

efforts  to  fight  crime  on  the  Internet  while  preserving  the  rights  conferred  by  the  Fourth 

Amendment  and  statute.  Ultimately,  the  decision  as  to  the  appropriate  parameters  of  law 

enforcement  activity  lies  squarely  within  the  Constitution  and  the  elected  representatives  of  the 

people,  the  Congress.  The  need  to  protect  the  privacy  of  the  American  people  -  not  j  ust  from  the 

government  but  also  from  criminals  -  is  a  paramount  consideration,  not  just  in  the  context  of  the 

Internet,  but  in  general.  The  Department  of  Justice  stands  ready  to  work  with  this  Subcommittee 

and  others  to  achieve  the  proper  balance  between  the  important  need  for  protecting  privacy  and 

the  need  to  respond  to  the  growing  threat  of  crime  in  cyberspace.  , 

Mr.  Chairman,  that  concludes  my  prepared  statement.  I  would  be  pleased  to 

attempt  to  answer  any  questions  that  you  may  have  at  this  time. 
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Statement  for  the  Record  of 
Donald  M.  Kerr 
Assistant  Director 
Federal  Bureau  of  investigation 
Before  the 

United  States  House  of  Representatives 
The  Committee  on  the  Judiciary 
Subcommittee  on  the  Constitution 
,  Washington,  D.C. 

7/24/2000 

Good  afternoon,  Mr.  Chairman,  and  Members  of  the  Subcommittee.  I  am  grateful  for  this 
opportunity  to  discuss  the  FBI’s  Internet  and  data  interception  capabilities  and  to  help  set  the 
record  straight  regarding  this  important  issue.  I  would  like  to  first  discuss  FBI’s  legal  authority  for 
conducting  interceptions  on  the  Internet,  and  then  describe  Carnivore  and  how  we  use  it. 

Two  weeks  ago,  the  Wall  Street  Journal  published  an  article  entitled  "FBI’s  system  to  covertly 
search  e-mail  raises  privacy,  legal  issues."  This  story  was  immediately  followed  by  a  number  of 
similar  reports  in  the  press  and  other  media  depicting  Carnivore  as  something  ominous  and  raising 
concerns  about  the  possibility  of  its  potential  to  snoop,  without  a  court  order,  into  the  private  E- 
mails  of  American  citizens.  I  think  t  hat  it  is  important  that  this  topic  be  discussed  openly-and  in 
fact  this  was  the  purpose  behind  the  FBI  choosing  to  share  information  regarding  this  capability 
with  the  industry'  experts  several  weeks  ago.  It  is  critically  important  that,  as  technology,  and 
particularly  communications  technology,  continues  to  evolve  rapidly,  the  public  be  guaranteed  that 
their  government  is  observing  the  statutory  and  constitutional  protections  which  they  demand  I 
bekeve  that  it  is  also  very  important  that  these  discussions  be  placed  into  the  context  into  which 
they  properly  belong  and  that  the  tree  facts  concerning  this  issue  are  made  clear.  More  to  the  point, 
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that  these  capabilities  are  used  only  with  lawful  authorization  and  that  they  are  directed  at  the  most 
egregious  violations  of  national  security  and  public  safety. 


Ftrst  of  all,  the  FBI  performs  interceptions  of  criminal  wire  and  electronic  communications, 
including  Internet  communications,  under  authori  ties  derived  in  part  from  Title  Iff  of  the  Omnibus 
Crime  Control  and  Safe  Streets  Act  of  1 968  (as  amended),  which  is  commonly  referred  to  as  "Title 
III",  and  portions  of  the  Electronic  Communications  Privacy  Act  of  1986  (as  amended),  or 
"ECPA",  I  want  to  stress  that  all  such  interceptions,  with  the  exception  of  a  rarely  used 
"emergency"  authority  or  consent  of  a  participant  in  the  communication,  are  performed  under  a 
court  order  issued  by  a  judge.  Under  emergency  provisions,  the  Attorney  General,  the  Deputy  or 
the  Associate  Attorney  General  may,  if  authorized,  initiate  electronic  surveillance  of  wire  or 
electronic  communications  without  a  court  order,  but  only  if  an  application  for  such  order  is  made 
within  48  hours  after  the  surveillance  is  initiated. 

■V 

Federal  surveillance  laws  must  comply  with  the  Fourth  Amendment's  dictates  concerning 
reasonable  searches  and  seizures,  but  they  also  include  a  number  of  provisions  that  arc  intended  to 
ensure  that  this  investigative  technique  is  used  judiciously  and  with  deference  to  the  privacy  of 

intercepted  subjects  and  certainly  with  deference  to  the  privacy  of  those  who  are  not  the  subject  of 
the  court  order. 


For  example,  unlike  search  warrants  for  physically  searching  a  house,  under  Title  111  and 
Department  oflustice  policy,  applications  for  interception  of  oral,  wire  and  electronic 
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communications  require  the  authorization  of  a  high-level  Department  of  Justice  (DOJ)  official 
before  the  local  United  States  Attorneys  offices  can  make  an  application  to  a  federal  court 
Further,  interception  of  communications  is  limited  to  certain  federal  criminal  offenses. 

Applications  for  electronic  surveillance  must  demonstrate  probable  cause  and  state  with 
particularity  and  specificity:  the  offenses  being  committed,  the  telecommunications  facility  or 
place  from  which  the  subject’s  communications  are  to  be  intercepted,  a  description  of  the  types  of 
conversations  to  be  intercepted,  and  the  identities  of  the  persons  committing  the  offenses  and 
anticipated  to  be  intercepted.  Thus,  criminal  electronic  surveillance  laws  focus  on  gathering  hard 
evidence—  not  intelligence. 

Applications  must  indicate  that  other  normal  investigative  techniques  have  been  tried  and  failed  to 
gather  evidence  of  crime,  or  will  not  work,  or  are  too  dangerous,  and  must  include  information 
concerning  any  prior  electronic  surveillance  regarding  the  subject  or  facility  in  question.  Court 
orders  are  initially  limited  to  30  days,  with  extensions  possible,  and  must  terminate  sooner  if  the 
objectives  are  obtained.  Judges  may,  and  usually  do,  require  periodic  reports  to  the  court, 
typically  every  7  to  10  days,  advising  it  of  the  progress  of  the  interception  effort.  This  assures 
close  and  on-going  oversight  of  the  electronic  surveillance  by  the  United  States  Attorney's  office 
handling  tire  case  and  frequently  the  court. 
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Interceptions  are  lequired  to  be  conducted  in  such  a  way  as  to  "minimize  the  interception  of 
communications  not  otherwise  subject  to  interception"  under  the  law,  such  as  unrelated,  irrelevant 
and  non-criminal  communications  of  the  subjects  and  of  others  not  named  in  the  application 


To  ensure  privacy  protection  and  evidentiary  integrity  of  the  communications  that  are  intercepted 
such  intercept  ed  communicat  ions  are  req  uired  to  b  e  recorded,  if  possible,  on  tape  or  o  ther  device, 
and  recorded  in  such  a  way  as  will  protect  the  recording  from  editing  or  other  alterations. 
Immediately  upon  the  expiration  of  the  Interception  period,  these  recordings  are  then  required  to 
be  presented  to  the  federal  district  court  judge  and  sealed  under  his  or  her  directions.  The  presence 
of  the  sea!  shall  be  a  prerequisite  for  their  use  or  disclosure,  or  for  the  introduction  of  evidence 

derived  from  the  tapes.  Applications  and  orders  signed  by  the  judge  are  also  to  be  sealed  by  the 
judge. 


W  ithin  a  reasonable  period  of  time  aft  er  the  termination  of  the  intercept  order,  including 
extensions,  the  judge  shall  ensure  that  the  subject  of  the  interception  order,  and  other  parties  as  are 
deemed  appropriate,  are  furnished  an  inventory,  providing  notice  of  the  order,  the  dates  during 
which  the  interceptions  were  carried  out,  and  whether  or  not  the  person  was  intercepted.  Upon 

motion,  the  judge  may  also  direct  that  portions  of  the  contents  of  the  intercepted  communication 
be  made  available  to  for  their  inspection. 


Any  person  who  was  a  party  to  an  intercepted  communication  or  was  a  party  against  whom  an 
interception  was  directed  may  in  any  trial,  hearing,  or  other  proceeding  move  to  suppress  the  con- 
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tents  of  any  intercepted  communication  or  any  evidence  derived  therefrom  if  there  are  grounds 
demonstrating  that  the  communication  was  intercepted  in  violation  of  Title  III,  EC-PA  or  the 
Fourth  Amendment, 


The  illegal,  unauthorized  conduct  of  electronic  surveillance  is  a  federal  criminal  offense 
punishable  by  imprisonment  for  up  to  five  years,  a  fine,  or  both,  in  addition,  any  person  whose 
communications  are  unlawfully  intercepted,  disclosed,  or  used,  may  in  a  civil  action  recover  from 
the  person  or  entity  engaged  in  the  violation  civil  damages,  including,  if  appropriate,  punitive 
damages,  as  well  as  attorney's  fees  and  other  costs  incurred. 


1  he  technical  assistance  of  the  service  providers  in  helping  a  law  enforcement  agency  execute  an 
electronic  surveillance  order  is  always  important,  and  in  many  cases  it  is  absolutely  essential.  This 
circumstance  is  increasingly  the  case  with  the  advent  of  advanced  communications  services  and 
networks  such  as  the  Internet.  Title  III  mandates  service  provider  assistance  incidental  to  law 
enforcement's  execution  of  electronic  surveillance  orders  by  specifying  that  a  court  order 
authorizing  the  interception  of  communications  shall  upon  the  request  of  the  applicant,  direct  that 
a  “service  provider,  landlord,  custodian,  or  other  person  shall  furnish  the  applicant  forthwith  all 
information,  facilities,  and  technical  assistance  necessary  to  accomplish  the  interception 
unobtrusively  and  with  a  minimum  of  interference  with  the  services  that  such  service  provider, 
landlord,  custodian,  or  person  is  according  the  person  whose  communications  are  to  be 
intercepted.” 
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In  practice,  judges  may  sign  two  orders:  one  order  authorizing  the  law  enforcement  agency  to 
conduct  the  electronic  surveillance,  and  a  second,  abbreviated,  assistance  order  directed  to  the 
semce  provider,  specifying,  for  example  in  the  case  of  E-mail,  the  E-mail  account  name  of  the 
subject  that  is  the  object  of  the  order  and  directing  the  provision  of  necessary  assistance. 

t 

Semce  providers  and  their  personnel  are  subject  to  the  electronic  surveillance  laws  like  public 
officials  and  private  persons.  That  is,  unauthorized  electronic  surveillance  is  forbidden,  and 
criminal  and  civil  liability  may  be  assessed  for  violations.  Not  only  are  unauthorized  interceptions 
proscribed,  bu  t  so  also  is  the  use  or  disclosure  of  the  contents  of  communications  that  have  been 
illegally  intercepted.  It  is  for  this  reason,  among  others,  that  service  providers  typically  take  great 
care  in  providing  assistance  to  law  enforcement  in  carrying  out  electronic  surveillance  pursuant  to 
court  order.  In  some  instances,  service  providers  opt  to  provide  “full"  service,  essentially  carrying 
out  the  interception  for  law  enforcement  and  providing  the  final  interception  product,  but,  in  most 
cases,  service  providers  are  inclined  only  to  provide  the  level  of  assistance  necessary  to  allow  the 
law  enforcement  agency  to  conduct  the  interception.  I  want  to  stress  that  the  FBI  does  not  conduct 
interceptions,  install  and  operate  pen  registers,  or  use  trap  &  trace  devices  without  Jawiiil 
authorization  from  a  court  . 


In  recent  years,  it  has  become  increasingly  common  for  the  FBI  to  seek,  and  forjudges  to  issue, 
orders  for  Title  III  interceptions  which  are  much  more  detailed  than  older  orders  which  were 
directed  against  “plain  old  telephone  services."  These  detailed  orders,  in  order  to  be  successfully 
implemented,  require  complex  approaches  to  ensure  that  only  messages  for  which  there  is 
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probable  cause  to  intercept,  are,  in  fact,  intercepted.  The  fact  that  court  orders  are  becoming  more 
detailed  is  in  response,  I  think,  to  two  facts. 


First,  the  complexity  of  modern  communications  networks,  like  the  Internet,  as  well  as  the 
complexity  of  modern  users’  communications  demand  better  discrimination  than  for  older  analog 
communications.  For  example,  Internet  users  frequently  use  electronic  messaging  services,  like  E- 
mail,  to  communicate  with  other  individuals  in  a  manner  reminiscent  of  a  telephone  call,  only  with 
text  instead  of  voice.  Such  messages  are  often  the  targets  of  court  ordered  interception.  Users  also 
use  services,  like  the  world  wide  web,  which  looks  more  like  print  media  than  a  phone  call. 
Similarly,  some  Interact  services,  like  streaming  video,  have  more  in  common  with  broadcast 
media  like  television,  than  with  telephone  calls.  These  types  of  communications  are  less 
commonly  the  targets  of  an  interception  order. 

1  he  second  fact  is  that  for  many  Internet  services,  users  share  communications  channels, 
addresses,  etc.  These  facts  make  the  interception  of  messages  for  which  law  enforcement  has 
probable  cause,  to  the  exclusion  of  all  others,  very  difficult.  Court  orders  are  therefore  increasingly 
written  to  include  detailed  instructions  for  ensuring  that  the  privacy  of  communications  for  which 
there  is  no  probable  cause  to  intercept  is  guaranteed.  ......  .. 

In  response  to  a  critical  need  for  tools  to  implement  these  complex  court  orders,  the  FBI  developed 
a  number  of  capabilities  including  the  software  program  called  “Carnivore.”  Carnivore  is  a  very 
specialized  network  analyzer  or  “snifter”  which  runs  on  a  normal  Personal  Computer  running  the 
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Microsoft  Windows  operating  system.  I,  works  by  -sniffing"  the  proper  portions  of  nelwotk 
packets  and  copying  and  storing  only  those  packets  which  match  a  finely  defined  filter  set 
programed  in  conformity  with  the  coon  order.  This  filter  set  can  be  extremely  complex,  and  this 
provides  tile  FBI  with  an  ability  to  collect  transmissions  which  comply  with  pen  register  court 
orders,  trap  &  trace  court  orders.  Title  III  interception  orders  etc. 


ft  is  important  to  distinguish  now  what 


is  meant  by  “sniffing.”  The  problem  of  discriminating 


between  users’  messages  on  the  Internet 


is  a  complex  one.  However,  this  is  exactly  what 


Carnivore  does.  It  does  NOT  search  through  the  contents  of  every  message  and  collect  those  tha, 
contain  certain  key  words  like  "bomb"  or  “drugs."  I,  seleds  messages  based  on  criteria  expressly 
set  out  in  the  court  order,  for  example,  messages  transmitted  to  or  from  a  particular  account  or  to 
or  from  a  particular  user.  If  the  device  is  placed  a,  some  point  on  the  network  where  it  cannot 
discriminate  messages  as  set  out  in  the  court  order,  i,  simply  lets  all  such  messages  pass  by 


unrecorded. 


One  might  ask,  -why  use  Carnivore  a.  all?"  In  many  instances,  ISPs,  particularly  the  larger  ones, 
maintain  capabilities  which  allow  them  to  comply,  or  partially  comply  with  lawful  orders.  For 
example,  many  ISPs  have  the  capability  to  “done”  or  intercept,  when  lawfully  ordered  to  do  so,  E- 
matl  to  and  from  specified  user  accounts.  In  such  cases,  these  abilities  are  satisfactory  and  allow 
full  compliance  with  a  court  order.  However,  in  most  cases,  ISPs  do  not  have  such  capabilities  or 
cannot  employ  them  in  a  secure  manner.  Also,  most  systems  devised  by  service  provide*  or 
purchased  "ofi  the  shelf"  lack  the  ability  to  property  discriminate  between  messages  in  a  fashion 
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that  complies  with  the  court  order.  Also,  many  court  orders  go  beyond  E-mail,  specifying  other 
protocols  to  be  intercepted  such  as  instant  messaging.  In  these  cases,  a  cloned  mailbox  is  not 
sufficient  to  comply  with  the  order  of  the  court. 


Now,  I  think  jt  is  important  that  you  understand  how  Carnivore  is  used  in  practice.  First,  there  is 
the  issue  of  scale.  Carnivore  is  a  small-scale  device  intended  for  use  only  when  and  where  it  is 
needed.  In  fact,  each  Carnivore  device  is  maintained  at  the  FBI  Laboratory  in  Quantico  until  it  is 
actually  needed  in  an  acti  ve  case.  It  is  then  deployed  to  satisfy  the  needs  of  a  single  case  or  court 

order,  and  afterwards,  upon  expiration  of  the  order,  the  device  is  removed  and  returned  to 
Quantico. 

The  second  issue  is  one  of  network  interference.  Carnivore  is  safe  to  operate  on  IF  networks.  It  is 
connected  by  a  high  impedance  bridge  and  does  not  have  any  ability  to  transmit  anything  onto  the 
network.  In  fact,  we  go  to  great  lengths  to  ensure  that  the  Carnivore  is  satisfactorily  isolated  from 
the  network  to  which  it  is  attached.  Also,  Carnivore  is  only  attached  to  the  network  after 
consultation  with,  and  with  the  agreement  of,  technical  personnel  from  the  ISP. 


This,  in  fact  raises  the  third  issue-that  of  ISP  cooperation.  To  date.  Carnivore  has,  to  my 
knowledge,  never  been  installed  onto  an  ISP’s  network  without  assistance  from  the  ISP’s  technical 
personnel.  The  Internet  is  a  highly  complex  and  heterogeneous  environment  in  which  to  conduct 
such  operations,  and  I  can  assure  you  that  without  the  technical  knowledge  of  the  ISP’s  personnel, 
it  would  be  very  difficult,  and  in  some  instances  impossible,  for  law  enforcement  agencies  to 
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success&Ily  implemem,  a„d  ^  M.th  ^  s(i.a  of ^  jntercejjtta  ^  ^  rei 

also  depends  upon  ,he  tSP  personae.  t0  u„dmlMtl  fc  „  and 


particular  networks. 


Another  primary  consideration  for  using  Carnivore  is  data  integrity.  As  you  know,  Rule  90!  of  the 

Federal  Rules  of  Evidence  squire  the  auibentication  of  evidence  as  a  piecondidon  for  * 

admissibility.  The  use  of  the  Carnivore  system  by  the  FBI  to  intercept  and  store  communications 

Ptovdes  for  an  undisturbed  chain  of  custody  by  proving  a  witness  who  can  testify  *. 

retrieval  of  the  evidence  and  the  process  by  which  i,  was  recorded.  Performance  is  aiso  a  hey 

reason  for  the  use  of  Carnivore  over  commercial  sniffers.  Unlike  commercial  software  sniffers 

Carnivore  is  designed  to  intercept  and  record  the  seiected  communications  comprehensiveiy.  ’ 
without  "dropped  packets." 


in  conclusion,  1  would  like  to  say  that  over  the  last  five  year,  or  more  we  h  ■ 

yeafs  or  more>  wfe  have  Witnessed  a 

continuing,  steady  growth  i„  instances  of  computer-related  crimes,  including  traditional  crimes 
and  tetTorist  activities  which  have  been  planned  or  carried  out,  in  part,  using  the  Internet.  7*he 

■“*  “f  <he  hW  "‘f0rra“  C0,"m“,y  ,0  *•“"*  investigate  and  prevent  these  crimes  is  in 
P-.  dependant  upon  our  abiiity  to  iawMy  coiiec,  v*al  evidence  of  wrongdoing.  As  ,he  Imemet 

ecomes  more  complex,  so  do  the  ohaiienges  pia«d  on  us  to  ke^  pace.  We  could  no.  do  so 

the  continued  coopemtion  of  our  industiy  p»„ers  and  innovations  such  as  the  Carnivore 
software. 
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fc  forward  to  working  with  the  subcommittee  staff  to  provide  more  information  and  welcome 

>our  suggestions  on  this  important  issue.  I  will  be  happy  to  answer  any  questions  that  you  may 
have.  Thank  You. 
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S^^aV^6  sjf,con?m5tte®  be  »  or^er-  And  it’s  probably  going  to  be  necessary  for  the  staff  to 
close  the  doors,  otherwise  we  11  have  noise  from  the  hallways.  3  u  10 

In  recent  years,  with  the  growth  of  the  Internet,  the  FBI  has  encountered  an  increasing  number  of  criminal 
sfcrims  3tIOnS  m  W  UC  5  cnmxna  subiects  have  used  the  Internet  to  communicate  with  each  other  or  their 

beIlcvesmany  fatemet  sendee  providers  lack  the  ability  to  discriminate  between 
communications  in  order  to  isolate  the  specific  types  of  information  that  may  be  authorized  to  be 

SabS  five  iS/tolSS?  *?*  ^  d»signed  and  deve?°Ped  a  program  called  Carnivore  which 
enables  the  FBI  to  isolate,  intercept  mid  collect  communications  that  are  the  subject  of  lawful  orders. 

Came  U  April  duriR!  tes^mmy  before  the  Subcommittee  on  the  Constitution 
rnl  n^5,^.R°b  rt  Com*R®vere^  who  represented  an  Internet  service  provider  that  tried  to  resist  attaching 

the  Carnivore  program  to  its  network.  <uwcmng 

frSSiSSSS?11*  °ne,°ftbe  af?m  !argest  Intemet  service  providers,  EarthLink,  Inc.,  has 
access  servers'  to  S«h  Iutni««t'tS  net%v?rk  because  attaching  the  program  m  the  past  caused  its  remote 

Other  ISPs  have  stated  publicly  that  they  would  challenge  an  order  to  attach  to  their  networks. 

While  these  industry  officials  have  expressed  willingness  to  cooperate  with  law  enforcement  to  comely 

w  Jfcj  C0Uft  <?dei?’  concerned  about  the  effects  attaching  Carnivore  to  their  network  * 

"  ill  have  on  the  security  of  their  infrastructure  and  the  privacy  of  their  customers. 

°n  My  1 2>  Attorafy  General  Reno  stated  that  she  does  not  want  Carnivore,  quote 
to  be  a  tool  that  is  m  any  way  a  cause  of  concern  for  privacy  interests,”  close  quote.  Today's  hearing 
provides  federal  law  enforcement  the  opportunity  to  address  the  privacy  concerns  that  have  been  raised. 

umeLo^aWe^^hir/ !tmi-eS  ****  as  t0  whether  existing  statutes  protecting  citizens  from 

w SfoiemSfSf  nSf ,  1 ‘  ^ the  Fourth  appropriately  balance  the  concern  of 

StSSfi.  *  d  J-aw  *®forecmwit  IS  concerned  that  the  information  needed  to  keep  the 

public  safe  remains  available.  Individual  citizens  are  concerned  that  a  sufficient  degree  of  privacy  and  the 

232 ^heSSfalSSSf 1 1  be  b  u  T  °{mod*m  communicatiofs  and  Information 

?£3® V  «  hoa  that  may  have  traditionally  been  kept  in  a  file  cabinet  at  home  is  now 

hrterest  I  y  by  *  **”*  party  “  c>'ber5Pace- 1116  hearing  today  will  also  address  this  balance  of 


**  use  of  Carnivore,  it  is  important  that  our  deliberations  be  based  on  facts  and  not 


~“W  «■»  «*~—t  ftaPdon, 


I  look  forward  to  hearing  from  all  of  our  witnesses  today  and  Fd  now'  recognize  Mr.  Watt. 
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WATT:  Thank  you,  Mr,  Chairman, 


I  confess  that  up  until  about  10  days  to  two  weeks  ago,  I  had  paid  very  Hale  attention  to  this  whole 
Carnivore  project.  And  at  about  that  point  I  started  to  get  inquiring  telephone  calls  from  the  media  and 
press  about  what  I  knew  about  Carnivore,  I  don't  know  much  more  about  it  today,  and  that's  whv  I  want 
to  start  by  praising  the  chair  of  the  subcommittee  for  con  vening  this  hearing,  because  I  agree  with  the 
chair  that  whatever  information  we  have  and  however  we  proceed  as  a  committee  and  as  a  Congress 
needs  to  be  based  on  the  facts,  *  “ 

**X  *0  bring  to  this  hearing  a  level  of  open-mindedness  to  try  to  understand  the  facts  and  trv  to  figure 
b  JSS SSS 1  ^  What  diSP°Siti0n’ if  any’ m3y  be  reqU‘red  by  Congrass’  what 

I  suppose  I  would  be  less  Apt  honest  if  I  didn't  say  that  I  have  had  for  quite  a  while  a  generalized  concern 
about  the  government  s  ability  to  invade  the  privacy  of  its  citizens.  There  seems  to  me  to  be  a  growing 
world°f  genera  iZed  COnCem  about  B5s  Brother*sra  that  I  suspect  is  being  fed  by  the  increasing  electronic 


WATT:  When  the  fourth  Amendment  was  passed  and  put  into  the  Constitution,  there  was  at  least  a 
reeling  that  if  the  government  came  to  do  a  search,  it  at  least  had  to  bring  a  warrant  and  present  it  to  you 
or  come  and  fcick-in  your  door.  1  ; 

And  in  some  of  our  communities,  we  have  always  had  probably  an  exaggerated  fear  of  whether  the  latter 
was  likely  to  occur  than  the  former,  and  it’s  probably  from  that  perspective  that  1  have  always  had  this 
kind  of  genera  lized  concern  ,  J 

* 

But  notwithstanding  that,  1  will  make  every  effort  1  can  to  try  to  be  objective  and  impartial  about  this 

SSSiS? 1  fw  ■  gf  nefai  commen,ts  P°h{  yp the  context  in  which  we're  operating  and  point  up  the 

importance  of  having  such  a  hearing  as  this.  *  * 

From  my  perspec  tive  it’s  good  to  see  a  number  of  people,  who  as  long  as  the  unwarranted  searches  and 
wiretaps  and  invasions  or  potential  invasions  were  being  visited  on  parts  of  the  community  that  they 

concern 


opportunity  to  look  into  that  and  evaluate  it  And  I  welcome  the  opportunity  and  thank  "the  chairman  for 
convening  the  hearing  for  that  purpose. 

Thank  you,  Mr.  Chairman,  I  yield  back. 

CANADY:  Thank  you,  Mr,  Watt. 

Mr.  Hyde? 


HYDE:  Thank  you,  Mr.  Chairman. 
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a  very  ^Portant  hearing,  as  attesfed  to  bv  the  interest  shown  with  so  manv  neoete 


:S?h;;m*d  *"***&  - 

£TS,!^ 

solE  “  ^  and  m  ProtectlnS  constitutional  rights.  I  hope  we  get  a  good 

Tliaak  you,  Mr.  Chairman. 

CANAD\ ;  Thank  you,  Mr.  Chairman. 

Mr.  Conyers? 

CONYERS;  Thank  you  very'  much, 

equivalent  of  wiretaps  on  the  Internet.  omtrcement  would  develop  ability  to  conduct  the 

4 

A 22SRS:  ThVlew?  abom  Carnivore  comes  at  a  time  when  there  is  growing  concern  about  W  msm. 
«ad  out  ""*•  «  h“  *«  «*  ™  - 

So  where  I  come  from  in  the  beginning  on  this  is  that,  are  we  minimizine  the  imprint;™  «r 
non-menminating  communications  of  a  target  of  a  wiretap  oi£?S  to 

enforcement  access  to  the  communication  of  non-targets9  And  I  think  this  is  a  verv  inmerta  ^ 
that  has  to  bejesoived.  h  *  mmx  tms  3S  a  verT  important  question 

StS£ toSaS  ofdmQ Pen^sters* 30  ®e  pen-register 
the  mfonuatiJdu^^S^;^?  ** ^  enforceffient  ca«  ***  *  «P«*«P  &  get 

ciSfiSS1lle™iS?«;?S  Pkce  al0ng-side1the  {el<*hone  a«d  snail  mail  as  a  central  means  of 
^forcemeat  tools  --Yaw  enformnentnlSsTwfr^be  't^MtercepnmlawM  coc^^0^^^e\^aW 

f°r  i!leSaI  "”**  “  ^  h°pe  *"  ^ «  inspire  witSea°Sigy 


5&47? 
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p47? 


S??Sn0f  «^1!'  1  thlIf  ^  *S  is  exactiy  {hc  *yPe  of  approach  that  we  need  to  have  when  we’ 

looking  into  a  new  arena  of  your  legitimate  needs  for  surveillance  of  suspects. 


were 


And  I  thrnk  tlie  more  the  public  knows,  the  more  the  Congress  knows,  and  the  more  light  that  is  shed 
S£!!r]Ud^n?at  WJ 1  be  ,rendered-  And  so,  I  do  believe  that  the  FBI  has  engagedin  this 
well  as  that  of1he™S’s°n  t0°  ’ t0  ^ **  reVICW  °f  third' party  documents  as  we}!  -  or  content  ~  as 

«“  le£itimate  questions  that  need  to  be  asked.  One,  is  this  new  technique 
Kiev  SSn^f?*Se  */*?*?£ W  mt0  m  *»“  m  1  did  not  have  when  I  was  a  United  States 
totally  LwenSmnmtS'  approva5> we  had  pen  registers,  but  this  is 

reSoLS^to  i«f d Vth11?  Cat  tbfhBI has  t0  s.teP  guigerly,  but  we  all,  obviously,  have 

responsibility  to  engage  in  legitimate  law  enforcement  activities  in  terms  of  surveillance 


is  a 
a 


fS* ith*w^*er  Wny  tophr?ss  the  question  is,  who  reviews  and  controls  the  appetite  of 
Carnivore?  I  think  that  that  is  really  what  the  purpose  of  this  hearing  is.  iP 

;^d5*wf  S°f  to  the  new  arena  of  privacy,  I  think  we  all  have  to  recognize  how  complex  this  i 


is  m  its 
ve 

Government 


aiS%  yel  ,hey  S“"  W  *  Pnvacy  h  tte  MOT3ti” 


law  enfor°4SemPS^°afS  resP°^ibiJhies  of  the  commission  would  be  to  review  the  activities  of 

taw  enforcement  in  terms  of  pnvacy  and  its  impact  on  privacv.  So  it's  not  just  commercial  bin  if* 

STcanToo^katnot  hfir^  ^forcemJP*’ a  broad-ranging  privacy  commission.  And  this  is  one  thing  that 
we  can  look  at  not  m  a  reactionary  fashion,  but  in  a  steady,  thoughtful  fashion  and  set  the  f 
miQ  me  next  century* 


;  tone  as  we  enter 


So*  with  that*  Mr,  Chairman,  I  want  to  again  thank  you, 

I  look  forward  to  the  testimony  of  the  witnesses, 

CANADY:  Thank  you,  Mr.  Hutchinson. 

The  gentleman  from  Alabama  is  now  recognized  for  five  minutes, 

BACHUS:  I  thank  the  chairman. 

l^A^A 0b:rs!y  ,wb,at  w,e  have  herc  is that  technology  has  outrun  the  Jaw.  We  have  a  Internet  exnlosion 
I  have  two  concerns  that  I  would  express  to  you.  One  is  that  we  have  a  balance  between  legitimate  law 
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Skncemen£  ReCdS  8nd  thC  ri§ht  ofprivacy’ that  we  **y  to  mamtain  that  balance,  which  is  a  delicate 


The  second  is  that  we  have  a  balance  between  our  different  types  of  communications.  Because  if  we  have 
certain  types  of  communications  where  we  ha  ve  the  potential  to  monitor  everything  that  goes  through 
fS  KT  other  types  of  communications  that  we're  limited  in  our  surveillance,  criminals  are 
wn  bc$e  °nCS  to.*P"  out  wbat  13  thetr  safest  tnode  of  communications.  And  sooner  or  later 

Of! co^ScaSr?£SitSre  *yP-  oftcommmk^s  bm  no{  a  !ot  ofr^ in  another 
*  CnmmaIs  are  «om^ to  raove  t0  the  least  restricted  or  the  least  monitored 

/ 

And  of  course  we  ve  got  to  ask  ourselves  what  level  of  monitoring  do  we  as  a  country  want  to  have  on 
private  conversations,  to  achieve  what  level  of  surveillance?  ?  on 


v^nrW  ’nf'^  !tme  blve  y°V  an  example.  Today  -  and  tins  is  an  example,  sort  of,  quote,  "from  the  old 
'  *oday.!  corosng  wio  JbJS  country,  Federal  Express  packages  are  randomly  opened,  UPS 

packages  are  randomly  opened,  but  U.S.  marl  is  not.  1  mean,  the  mail  is  not  opened.  Now  criminals  have 

oSr-?i  i8Uredf?U\  rf  the.fa™st  way  of  15?ai}in8  something  in  the  United  States  is  not  UPS  or  Fed  Ex 
or  pared  post,  use  the  U.S.  mail.  The  same  going  out.  They've  adjusted.  They  found  out  where  the 

loopholes  are.  They  found  out  where  the  least  surveillance  is,  and  thev've  gone  with  using  the  U  S  nHl 
to  send  things,  because  they  are  not  randomly  checked.  '  8  8  Ub*  maj3 

oJfn^mr  alS  2re  P*0#  t?„fi8urc.out» sooner  or  later,  I  would  think  -  and  my  question  to  von.  aren't  thev 
gomg  to  figure  out  —  the  illustrations  you  have  given  us  is  that  you  can  take  a  work  like  "bomb"  and  vm\ 
can  search  the  internet  for  bomb.  Well,  aren't  our  criminals  -  aren't  terrorist Sstfnce,  St  Sey 

*°  USe  WOrd  ,,bonlb?" 1  mean>  wotl’{  they  figure  out  to  use  the  word 

ot£  worf^Won't  '  AS,°PP0Selt0  exp!osive  device>  WOfl‘*  *ey  come  up  with  some  kind  of 

baskanvJeft^ o?  swieS/Sff 2  W3*>  bey0rf  yo\U31«S  k?y  words* t0  get  around  this?  And  you're 
oasjcauj  left  on  sweeping  the  conversations  of  law-  abiding  citizens?  How  do  vou  act  around  enminsk 

s"ysreSe  8°mg  t0  Pt  t0  tWs  SyStem?  rney're  {o  *** »  ^ 

And  at  the  same  time  my  other  concern  is  this;  I've  heard  all  sorts  of  assurances  that  this  won’t  fall  in  the 
/Wfa  8  bands,'  t?at  diere  are  safeguards.  Well,  today  there  are  safeguards  on  FBI  files.  FBI  files  only 
certain  people  have  access  to  those  files.  Only  certain  people  can  have  possession  of  those  files  Only 

JJJ2J2  ?anJook  m^bose  fl5es*  Yet  a  few  years  ago,  we  found  out  that  1,000  of  those  files  were 

wherfweSe1  HvJS  do  weJ»VC  *at  we're  nQt  8o5“8«>  have  another  situation  here 

vhere  we  have,  like  FBI  files,  that  they  got  out  of  the  restricted  area  and  that  people  viewed  them  and 

perhaps  utilized  them  for  things  they  weren't  intended  to  be?  P  P  em  and 

thev've  SS2Ste1SfiUre*  tbatAbave  about.mS  agents  who  pull  people's  income  tax  forms  and 
me>  ve  used  them  to  go  up  against  their  wives  m  court  or  their  ex-wives  on  child  sunnort  matters  or 

£SC?faga!f  someone  who  was  dating  their  girlfriend  to  try  to  embarrass  them.  And  there've 

S:  a  assured  wouldf not  Sf  dlf  Wltb  fi,f  or  what  confidential  information,  which  we 

their  ?  d  i?!  f  1  ~  d  fce  restricted,  where  someone  used  those  files  within  the  IRS  to 

uieir  advantage  or  to  embarrass  someone  else. 


intended. 
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So  I'd  ask  you,  how  would  this  be  any  different?  How  is  this  any  different  from  IRS  information  which 
toJ“  would  not  be  disclosed  and  has  been  in  any  number  of  cases?  How  is  this  any  different  from 
FBI  files  who  found  themselves  being  used  for  political  purposes? 


Thank  you. 


CANADY:  Thank  you. 


We  w'iJJ  now  move  to  hearing  testimony  from  our  first  panel  Our  first  panel  will  address  the  Federal 
Bureau  of  Investigation’s  Carnivore  program  and  its  role  in  federal  law  enforcement  in  the  digital  age. 


On  this  panel  first  we  would  like  to  welcome  Dr.  Donald  Kerr.  Dr.  Kerr  is  an  assistant  director  of  the 
Federal  Bureau  of  Investigation  and  director  of  the  FBI's  Lab  Division,  which  develops  surveillance 
and  tactical  communications  technologies. 


Next  we  will  hearing  from  Larry  Parkinson,  the  general  counsel  for  the  FBI. 


Following  Mr.  Parkinson  will  be  Kevin  V.  DiGregory,  Mr.  DiGregory  is  deputy  associate  attomev 
f?ne£^,at  &e  Department  of  Justice.  Two  members  of  the  Justice  Department's  Computer  Crimes  unit  - 
Mr.  DiGregory  is  joined  at  the  table  today  by  Christopher  Painter,  the  deputy  chief  of  the  Computer 
Crime  and  Intellectual  Property  Section  at  the  Depai  tment  of  Justice.  Mr,  Painter  will  not  be  making  a 
separate  statement,  but  will  be  at  the  table  with  Mr.  DiGregory  to  answer  questions. 


I  want  to  thank  each  of  you  for  being  with  us  here  today  and  for  patiently  li  stening  to  our  open  ing 
statements.  I  would  ask  that  you  do  your  best  to  summarize  your  testimony  in  five  minutes  or  less, 
although  I  don’t  think  anyone  will  insist  on  strict  adherence  to  the  five-minute  rule.  And  without 
objection  your  full  written  statements  will  be  made  a  part  of  the  permanent  record  of  today's  hearing. 


Dr,  Kerr. 

KERR:  (OFF-MIKE)  grateful  for  the  opportunity  to  discuss  with  you  our  program  for  interception,  lawful 
interception,  of  information  on  the  Internet  and  data  networks. 


As  you  know,  the  use  of  computers  and  the  Internet  has  grown  rapidly  and  has  been  paralleled  by  the 
exploitation  of  computers,  networks  and  databases  to  commi  t  crimes  and  to  harm  the  safety,  security  and 
privacy  of  others.  Criminals  use  computers  to  send  child  pornography  to  each  other  using  anonymous 
encrypted  communications.  Hackers  break  into  financial  service  company  systems  and  steal  customers' 
home  addresses  and  credit  card  numbers.  Criminals  use  the  Internet's  inexpensi  ve  and  easy 
communications  to  commit  large-scale  fraud  on  victims  all  over  the  world.  And  terrorist  bombers  plan 
their  strikes  using  the  Internet. 


Investigating  and  deterring  such  wrongdoing  requires  tools  and  techniques  designed  to  work  with  new 
and  evolving  computer  and  network  technologies.  The  systems  employed  must  strike  a  reasonable 
balance  between  competing  interests:  the  privacy  interests  of  telecommunications  users,  the  business 
interests  of  service  providers,  and  the  duty  of  government  investigators  to  protect  public  safety. 


ft 
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LT  “S  3*5  S’SbminS^'Si1'"6',1”  */  T  sf,??mk  mail 

HlS’atauuie  Carnirore^Sf  ^ what?s?t  h'™  ?S  “<!lel'ca?n™uni“lio”s  “are  requires  me  to  talk  a 
some  in  the  networicing  industry  wuld  calUmcktSfTer  ftat  2  sometSi^hSo ^  f “ch  ®*  'vha< 

that's  passing  through  that  service  provider's  portal  oraerto  get  a  part  of  the  traffic 

£?£  2m  WC  tCqUke  a  court  order-  ‘Hat  com  order  is  specific  to  the  numbers  we  can  tarnet  if 
in  fact,  full  contend  equivalent  of  a  pen-register,  trap-and  trace,  or, 

not  authorizeVb? a  court°orfe  °f  surveillance  with  this  system.  That’s 

f aSk’ 

Second,  we’re  able  to  also  sort  on  the  "to”  and  "from"  line  of  the  e-mail  ,  '  ,,  , 

about  that  is  think  about  the  piece  of  standard  mail  mat ifs  frSk *1  Wt™  >b!  °!f  besf  wa>Jt0Lthmk 

!25^Arsfcs*rAW 

autb^edtoopTh^ 

what  *a  1 10 WS  US  {?/erT'er  conteB*» we>re  abJe  to  open  the  envelope  And  in  this  case 

wnat  we  would  then  do  is  capture  all  of  the  packets  that  relate  to  that  e  mail  uZ71t*  ,f tase’ 

soble  medium  -  magnetic  tape  or  some  other  stable  medium  -  for  iaS^semWy  .  S££,’ 

cow«4«BS*£SISStt5^2rf^i^SKcS12S^>i!^’^i^wia*to 

technical  people  from  the  Internet  service  provide?  ’  d’ m  ever>  case*  b>' 0118  or  more 

place,  is  not  made  up^^ca^agent  leadfng  ^ thVhrvestij^thm^Th^s  !ecords.Ittor  Puts  the  system  in 

^nsibirbaWy  alS°  “Cl‘“'eS "  ‘hmn&  ^nician^&^Sirffi^  °r  m0re 


headquarters^  *  **“  ****  °R  SitC  Until  it<S  recorded  and  ^turned,  either  to  a  field  office 


or  to  us  at 


And  the  installation,  to  put  a  picture  in  your  mind,  looks  very  much  like  a  desktop 


Oof  76 


personal  computer.  It’s 
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often  bolted  into  a  rack  like  other  equipment  at  the  Internet  service  provider  location  but  an  ,Wrt9n* 
difference  is  that  it  has  no  keyboard,  no  mouse,  and,  in  fact,  it's  looted  up,  as  far  Se  enSS? 

wh5e-the  magrsetic  media  are  written,  because  this,  in  fact,  is  the  first  step  in  the  evidential 
rnfwffifdtS0  rf  ®imPortanttha|, !t  be  locked,  access  only  provided  to  an  agent  who  comes  on  site  to  ° 

,Mt!  i,jua  like  W*  ““  ““«*  ta  <™»  of 

An  important  further  point  is  that  we  produce  a  record  for  audit  of  the  filter-sett  in  2  and  the  ermfiatw-ui™ 

^ ?he  *“**  kw  tbnes  ^at  &  was  used*  diat  was  done  by  the  people  doing  the^ 
installation.  We  ve  now  grown  concerned,  because  of  discussions  that  have  beenongoing  that  we  record 

tried roarSi°t?f  ffd  so  we  now>  “  fact,  override  it  with  a  hash,  so  that  if  someone 

tried  to  rewrite  that  audit  trail,  that  could  be  detected,  someone 

**  ’,eeon,es  part  of  1 *•  »— 


mSUSfvTd  110  ?a«  shouJd  forg«  that.  There  are  both  criminal  and 
federal  felonv  ®  ar!r  Hecl™nic  Communications  Privacy  Act  installations.  It's  a 

damaces  >5  g  °r  3  pmon  term  of  UP t0  five  yeaw. a  fine,  plus  possible  recovery  of  civil 

And  so  I  don't  think  our  technical  teams  installing  these  devices  are  going  to  risk  their  inb«  ,h«v  >Wm-n„ 
and  their  future  by  attempting  to  operate  this  equipment  improperly  ft  $hf  ISP  j  ’ 

LrtaSon  £f  hSf  Wy  Jhkb- W  nTCt  the  busflss  aderests  of  the  service  providers:  every 

effidentl  v  uf’i  f i£t.bf  d  /, m-  conaborattlon  m{h  the  *«vice  provider'sjechnical  staff.  To  do  it 
efficiently,  we,  m  fact,  only  want  to  intercept  the  very  smallest  slice  of  the  relevant  traffic  And  in  fan 

Site  ti?  Ittf  “  teChniC/lly  fapabk  of  Perming  the  intercept, 

vlt!t  P  IA’  as  many  of  the  large  ones  do,  so  they  can  respond  to  the  court  order,  we  are  in  fact 

ordhr  aTlul°r  {bem,to.do  tbat  and  strn?ly  provide  us  the  information  which  is  the  subject  of  the  court’ 
order  and  we  never  do  install  our  equipment.  We  also,  in  those  cases,  bear  some  part  of  the  co  Sof doing 


sophistication  And  whem  Sl  rct  *  ha!C  ajfge  a5?omtS  °f  equipment  and  a  great  deal  bf  technical 

SSrt  oSilf  net^0rf' 11  Tly  recdves  ‘.fixation  through  the  filter  as  authorized  by  the 

I  in^vwav  wo md  n0rC0!nmunica{1^s  over  the  network.  So  we  don’t  believe  that 
e-mail  to  customers.  rf  th  the  pr0per  functioning  of  tbe  service  provider's  equipment  delivering 

iS  remo.v.ed  iuimediately  upon  the  expiration  of  the  court  order.  It  does  not 
o™ to  leave  iUnplace  Pr°Vlder’  “ 15  ^  ^  8d  b  m4  make  3  decision  011  their 
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feCia  m  tflc  loun  oraer-  in  2  sense,  it  s  automatic  minimization  up  front, 

Mofficetm  .  ta&Ztenlr « w"ln  fS  • ' Ka“s'  Jlen  P1'  m“saS«  are  reassembled  back  at  the 
shooldrt.  ifs,  in  fat  , SS  W Sat  time!  '  “COrKCt,y or  ■"advertently  captured  mforamlkm  we 


And  it  s  really  no  different  than  the  minimization  that  occurs  first  real-time  on  a  Title  ITT  wm»tan  ^a  *u 
subsequent  on  the  recording  of  that  wiretap  to  be  sure  there's  nS? tSe  St  shSulStb?  ?  *“ 


onnormS  aC  I”*  t  aPPrcTnate  &«  step  m  the  chain  of  custody.  We're  trying  to  maximize  tl 

opportunity  to  properly  gather  evidence,  authenticate  it  and  foe  able  to  testify  that  21\£ 

nor  subtracted  nor  altered  that  which  we’ve  captured.  ^  e  Ve  neither  added 


toSfh  ^fwnni0?1’  befauSf lts  3  combination  of  software  and  hardware.  And  so  we  can  in  fact  adjust  it 
to  fit  subsequent  court  orders,  and  we  can  move  from  one  case  to  another  with  it.  ’  JUSt  U 


“Sd  auSSt'™”'  of  comIMKi*1  »®ware '»  <•*«*  ride  md  cost,  and  as  I  mcMioned  before, 

Finally,  one  of  the  things  we*re  going  to  do,  as  a  consequence  of  our  discussion  over  the  la«  ?  «i  m(W,kr 
with  people  m  industry,  staff  and  members  of  Congress  five  of  the  nZrtZt  8  months, 

number  of  U.S.  attorneys  some  3  5  federal  ,  partment  of  ^stice  components,  a 

Ses  ,o — «*  **  ■*«*  ***  * 


But  what  we're  going  to  do,  is  very  alcin  to  what,  for  example,  NASA  does  with  software'^W^rW  #x 
their  launch  operations;  ask  some  independent  party  to  verify  that  the  software  that  «*»  t,  e  Cor 

mu,  re  ta,  do  those  things  to,  we  Jy  it  will  SSL  ^SSSSigZ 

Our  year-to-date  use  of  this  tool,  that  is  this  present  year — the  first  three  mzarrm  *wrtt  * 

deployed  it  some  16  times.  It’s  been  used  sixcnminll Sscs  mdW 

oftliose  were  simply  pen-registers,  some  involved  Ml  content.  None  of  those  cases  have  been  b 
numbefftls  reoortedin  th^ t0  deta?1stoda>'* hutl  it's  probably  of  interest  that  it’s  not  a  very  large 

where  .Ae'XC^^ 

and  to  target  it  precisely  and  well  at  those  that  the  court  orders.  authorized  to  use  this 
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Thank  you  very  much,  Mr.  Chairman. 


CANADY:  Thank  you  very'  much. 


Mr.  Parkinson? 

P ARKJNSON:  Thank  you,  Mr.  Chairman.  I  do  not  have  a  prepared  statement.  PH  be  very  brief. 


I  want  to  echo,  first  of  all,  what  Dr.  Kerr  said,  and  this  is  ~  despite  its  unfortunate  name,  this  is  a  tool  that 
is  very  surgical.  And  I  think  Representative  Hutchison  had  it  right,  that  this  really  is  a  minimization  tool 
And  PH  leave  the  technical  aspects  to  Dr.  Kerr. 


What  Pm  here,  primarily,  to  emphasize  and  Pm  delighted  to  be  here  and  answer  any  questions  that  the 
committee  may  have  --  is  to  emphasize  that  there  --  the  FBI  and  the  Department  of  Justice  have  a  true 
commitment  to  the  rule  of  law.  And  I  want  to  respond  just  briefly  to  the  notion  that  we  have  deployed  this 
system  without  controls  or  without  proper  authorization.  That  is  simply  not  the  case. 


P ARKINSON:  We  are  also  not  saying.  Simply  trust  us,  we're  the  government.  I  think  we  have  -  we’re  not 
naive.  We  have  -  we've  had  enough  situations  in  the  course  of  our  history'  to  know  that  that's  not  enough. 
We  have  significant  oversight,  both  within  the  bureau,  within  the  Department  of  Justice,  and  most 
importantly,  within  the  judicial  branch  that  overseas  deployment  of  this  device  and  any  other  surveillance 
device. 


In  addition  to  that,  we  obviously  have  vigorous  and  appropriate  congressional  oversight. 


So  that's  why  Pm  here.  Pm  happy  to  answer  questions.  And  I  just  want  to  emphasize  to  you  and  to  the 
American  people  that  this  is  a  tool  that  is  deployed  rarely  and  it  is  never  deployed  without  a  court  order. 
And  we  do  not  deploy  it  in  a  way  that  exceeds  the  court  order. 


It  is  very  discriminating,  and  I  hope  that  this  gives  us  the  opportunity  to  explore  that  and  give  some 
comfort  to  the  committee  as  well  as  to  the  American  people. 


Thank  you  very  much,  Mr.  Chairman. 


CANADY:  Thank  you,  Mr.  Parkinson. 


Mr.  DiGregory? 


DIGREGORY;  Thank  you,  Mr.  Chairman. 

Mr.  Chairman  and  members  of  the  subcommittee,  thank  you  again  for  allowing  me  th  is  opportunity  to 
testify  about  the  law  enforcement  tool.  Carnivore,  and  the  Fourth  Amendment. 
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We  have  seen,  as  Dr.  Kerr  has  noted,  magnificent  growth  of  the  Internet  over  the  last  1 0  years  and  it  has 
^tL^S^r“Ze"S- 0Ur  bUSinKSK  and  for  *»d  «  ««» to  hold  E'dti 

The  Internet  has  spurred  a  new  and  thriving  economy.  Many  businesses  have  prospered  by  providing 

imnmvftfoTS?1?  ser'^es  the  Internet.  Others  have  assisted  in  the  building,  maintaining  and 

anf  fateme**tsp5f-  ^ie  Internet  has  given  people  jobs,  supported  families  and  communities, 

Sr ^ Kss/ ,or  “l  fcrthe  worid- The  totOTa  hM  ,o‘KhKi 


J  >  7  -  —  —  tiiia  UifciUnoaj  UHUl,  JOVCO  1H  ttlC 

short  existence,  we  have  seen  a  wide  range  of  criminal  use  of  this  technology.  It  has 
besn  used  to  commit  traditional  crimes  against  an  ever-widening  number  of  victims, 

Stem^hself  th0Se  Cnmraa!s  mtent  on  stt2ckin8  and  disrupting  computers,  computer  networks  and  the 

In  short,  although  the  Internet  provides  unparalleled  opportunities  for  Americans  to  freely  exnress  ideas 
ualso  provides  a  very  effective  means  for  ill-motivated W>ns  to  breach  the  pricey  and  2SSJ  of  * 

woarld  **K  df in  <he A>'sicf 1  WOrld  are  tegimmg  to  appear  in  the  online 

Memet  *  ^  ’  extortIon>  fraud’  ldem!{>r  <**&  *>d  child  pornography  are  migrating  to  the 

addressi^  Privac>-  f  d  Pablie  safety  serve  as  a  framework  for  law 
?h5S  n5w  forumfor  criminal  activity.  If  law  enforcement  fails  property  to 

eroded*  7ddence  7n7^'7  f  my?mT™  Polio's  confidence  in  government  will  be 

eroaen,  evidence  will  be  suppressed,  and  criminals  will  elude  successful  prosecution. 

ivh^S^T  o  *  t007mid  ®  ponding  to  cyber-crime,  however,  we  will  in  effect  render 
authorized  80vemmcV“sSl.eSKe  °°”“n™icate  and  °«  «i™  without  fear  of 

en£ji!^ 

Proper  balance,  Mr,  Chairman,  is  the  key. 

hd5  mf^mblZZC&raiVOr6r  *• tmth  0f  1 the  matter  is  tiiat  Caf  aivore  is> in  reality,  a  tool  that 

our  obligations  *p  the  public  to  enforce  the  laws  and  preserve  public  safety,  we  use  the  same 

attSitilrSfsS  T*  online  as  we  do  in  the  physical  world,' with  the  same  careful 

auention  to  the  strict  constitutional  and  legal  limits  feat  are  imposed  upon  us. 
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Carnivore  is  simply  an  investigative  tool  that  helps  os  to  investigate  online  in  the  same  wav  a.  in  ih, 
enter,03  ^  d  3nd  Cn8b  £S  US  t0  °btak  °nly  the  ^  ere  authorized  to  obtain  through  a  murt 

To  illustrate:  Law  enforcement  often  needs  to  find  out  from  whom  a  drug  dealer  for  instance  k  w;„ 

is  s',,in8  his  8oods- " is  “  ta»«» 1 i 

25K^i2#5^^ 

0t  *  CWW  I’om  Whw  ”“y  *»  j>'a  “S  Italy  <0  «>J  an  e-mail  as 

foSthm  at  hSS1!?*??8  a  !rap  traceo/  a  pen-register  in  the  online  context,  however,  we  have 
tound  that  at  times,  the  Internet  service  provider  has  been  unable  or  even  unwilling  to  stmnlv  thk 

mfonnation.  ft  is  for  that  narrow  set  of  circumstances  that  the  FBI  designed  Carnivore  Law  enforcement 

reSp0nS,bIiity1t0  Protect  Pubbc  s^ety  simply  because  technology  has  changed  Rather 

mfe?afestot!e£ly  7?  eforcenfRt  will  continue  to  be  effective  as  criminal  activity  ’ 

migrates  to  the  Internet  W  e  cannot  do  this  without  tools  like  Carnivore, 

ordefand7nlvfo^fof^atS-PedTa/  ^^8  too!  that  can  gather  the  information  authorized  by  a  court 
onlfrhet  f  i!tn‘ 1  pemHtS  law  enfo«enwnt,  for  example,  to  gather,  pursuant  to  an  order 

an!4tman7?;nadSmSei0f7^  pefons  With  whom  Jhe  dealer  is  communicating  without  allowing 
odsfoe  £  !£££%?&£  JtdeT  ^  or  **  se™ce  P™**’  to  view  private  information 


In  other  words,  as  I  understand  it.  Carnivore  is  a  minimization  tool  that  permits  law  enforcement  m 
omply  wuh  court  orders,  to  protect  privacy  and  to  enforce  the  law  to  protect  the  public  interest,  * 

captaring0’  **  ^  ****  n°te4,  Caraivore  crea!es  «  audi{  trail  that  demonstrates  exactly  what  it  is 


D^'Si3?&jaVe,ltt  tools,  there  are  many  mechanisms  we  have  in  place  to  prevent 

Srelment  c?n^ foZfneZSh^Z^t  anJ tbe  of  course,  restrict  what  law 

“  i0  “““O'*  of  Title  in  and 


as  -f  *  “**  r^exan.-ph,  befcn, 

,  jt'  s  *  ut*  u^eti  io  micrcept  wire  or  electronic  cortuimnications.  with  a  limited 

digital  display  pagers,  the  requesting  investigative  agency  must  obtain  approval  for  the  Titiellf 
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application  from  the  Department  of  Justice. 


Specifically,  in  the  Department  of  Justice,  the  Office  of  Enforcement  Onentfonc  in  <k»  r«  •  ,  rv  •  - 

ste  aas£?"  *  8ira 

Justice  approve  a  Title  m  reouest  T3  r  , the  mvestigative  agenc>'  and  the  Department  of 
but  exacting  standanfc  *  ^  * o{coarse’ be  aPProved  b>'  proper  court  using  familiar 

violating  Title  m  «  the  Electmnic  Communication  M^SJ* f?r 

SSS'on1^a^g.“'  F°r  Foimh  TSZSSZSZ*. 

publicly  dtaemScdlototeS  mmsSb' d' ”1  t0be'f  ’'f0"  SMlera,«l  #om  the  review  will  be 

"Ss^ssa  sisffs  aspec,s  of,hc 

DIGREGORY :  The  Department  of  Justice  has  provided  the  committee  with  mb  cm 

m.  Painter  and  I  are  available  to  try  to  answer  any  of  your  questions  along  with  the  rest  of  the  panel. 

Thank  you,  Mr.  Chairman. 

CANADY ;  Thank  you  very  much. 


been  very'  helpful  to  us. 


testimony 


I  m  going  to  have  a  few  questions  and  other  members  will  have  auestiorK  Tdn  ■««»«*  o**u  *  *  * 

P^Me  m  Pn>babl,y  M  ,he  !hat «*  ««  to'i*. » m  would' Syiu to 

ES J£  •  nUm  resP°nses  t0  any  additional  questions  that  any  members  of  the  commiZttvW 
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Let  m/ ~  ha.ving  saidthat* let  me  B°  over  some  ground  that I  think  you've  already  covered  confirm**  tu 
use  of  Carnivore  under  the  pen-  register  or  trap-and-trace  authority  y  COncem3n8 the 

^'hen  you  re  using  the  pen-register  or  trap-and-trace  authority,  would  you  ever  obtain  any  letters  or 

iS'lwr  °t  ier  than  those  .^at  maJce  UP  an  e-mail  address,  such  as  MnSmithtlhome,com?  In  other 

autSffivfe  Jh  n  cuSJa  thmM  2°U  CJer  m4ake  3  reciuest> under  *e  pen-  register  or  trap-and-trace 
authority,  that  included  the  capture  of  words  or  sentences  other  than  the  e-mail  address? 

K£RR:  The  answer  from  our  side  in  terms  of  how  we  set  it  up  is  that  if  it’s  a  pen-resister  order  we  only 
get  the  two  address  and  we  capture  nothing  else,  8  raer  *e  onY 


PAINTER:  And  I  might  say  also  that  the  —  even  die  subject  line  we  consider  to  be  content  and  that 

mro^a.ion  ,hai  soi=ly,  J^K.'USho.e 

e-mail  address  when  you  re  using  the  trap-and-trace  or  the  pen-register  authority, 

PAINTER:  In  the  electronic  communications  context,  yes,  that's  correct. 

CANADA  .  Let  me  ask  you  this:  in  your  view,  does  federal  law  enforcement  have  the  authority  under  the 
h  asvisSf  ACt  40  CaptUre  S0‘calIed  mL  addresses> which  are  the  addresses  of  the  web  sites  a  person 

mSS  l^addrefV;  th^krRL  addresses  are  not  really  what's  contemplated  under  the 
could  bfcSS  f Ute* What  Ku  re  tal,km8  ?bout  there  ®  ”  *  mean,  it  could  -  it's  possible  it 

m^^cally  in  a 

ss&TSStssr ical,y  ““  * ,o  a  —ssjf  ^ 

CANADY:  If  you  would. 

l!SdLh!i!hat'j  iVeT  gl°?  PTL  tJere,are  s*™***  such  as  Hotmail,  where  U  have  to 
£  Jf  wf,b  faSe  and,tben  look  for  the  authenticators  and  other  indications  that  it’s  an  e-  mail  service 

don't  clnture  SS.Sc  5Sh  ^  C°  Sff  {°  Simply  ihe  e*mail  thafs  provided  through  that  service.  vK 

web  Sf we  rilrict  wbddUf  ^  ^ f?et* we,  are«ot  interested  in  what  they  do  when  they  surf  the 

weo,  ana  we  restrict  what  we  do  only  to  that  e-mail  traffic  over  the  web  page. 


CANADY;  OK, 


Now,  in  your  comments.  Dr.  Kerr,  you  indicated  that  Carnivore  has  been  used  only  a  few  times  I  think 
1 6  was  fee  number  for  this  year,  is  feat  correct?  y  es' 1 


KERR:  That's  correct;  1 6  times  this  year.  I  think  about  a  total  of  25  in  the  life  of  the 


program  over  the  last 
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CANADY:  Well,  over  that  same  time  period,  how  manv  Title  III  intereent«  nn  ^  mail  «4 
done  not  using  Carnivore?  y  intercepts  on  e-mail  would 


you  have 


S™6  USCd  C^rf  lvo,‘e  and  earlier  versions  of  the  same  technology,  and  in  some  other  csw 

commercial proSletto CaraivorefvS  kfecfto eeTsomeof th °e ?afn-tthat  J* ^?ved &o» the  ’ 
bnefed  you  on  earlier,  because  the  commercial  product  had  been  dcvetepldfoTqinTe  anSrpt^oS 1 

i 

5^?^  this  are  used  by  the  service  providersno  monitor  the  quality  of  their  sendee  In  that 

more^iIctkiinaktge^hntquefn  ***  ***  °bsCrVe‘ &  °ur  Case’ weVe  <*&*  Halted  and  need  the' 


CANADY:  My  time  has  expired,  but  by  unanimous  consent,  F!1  have  three  additional  nu 


minutes. 


Let  me  follow  up  on  that,  if-  let  me  change,  given  the  limited  amount  of  time,  to  a  different  subject. 

SforSmlrif6  >'0u.C0nten5P^ted  allowing  the  use  of  Carnivore  by  other,  not  only  federal  law  • 
enforcement  agencies,  but  state  or  local  law  enforcement  agencies?  ’  }  IecleralI<m  ' 


enforcement  We  u,sed  n  on  a{  5eas{  on£  occasion  m  support  of  another  federal  law 

enforcement  agency.  We  have  not  yet  brought  it  to  the  ooint  where  we  k..  Ah  i.  Ja 
oi  providing  it  to  state  agencies  p  her& wc  wouid  be  5alki«8  about  «t  m  terms 


*!»  « 1»M«I  **  so. 


.  necessanl)  assured  at  this  point  m  tune  that  it  would  be  a  suitable  tool  for 


us  to  turn  over. 


Su2araKSw SljKriTS 1  "“I'  reft™5c“.a  media  report  that  Earthlink  was  required  to 
cuSaroTo  lo£  Anti  <“’mg  S0'  °m  ■“*«*  ■»  and  i « 

Now,  from  your  comments,  Dr.  Kerr,  I  understand  that  that  just  shouldn't  harm™  ivt  tu~  u 
comments  about  those  reports  and  what  actually  took  place' there ^  ^ 

Earthlink.  lomng  of  an  ISP,  and  whether  you've  had  other  complaints  similantokat  madefy 

^S'et^than  What  nWf-  d0litry  \°  giv€  you  somelhi»g  &r  the  record  that’s  more 

compelled to  mo^ahe^S  Ek V™  f y  Wif^  Wen“°  Ea«blink  and  key  were  ultimately 
tried1 to  pm toSi  7  P  ^ 10  d° 11  software  that  they  essentially 
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f&enm' 


^^^^c^^^;s‘27Jis^lms^ar’:‘>ywe 


■  or  some 


ago,  but  in  terms  SSS^S? SSJSid^to^^  ab°Ut  three  years 

^ th*81 16  ofthem 


WATT.  It  seems  to  me  that  such  verification  would  have  taken  nlsee  *t  tnm.  r  _  _ 

mto  pubhc  concern  or  legal  concern,  ak  p  ce  at  some  earJser  stage,  not  25  cases 

S^,:  Jhe  essence  of  the  development  program,  of  course,  is  that  you  do  learn  is  vmt  vw»t™  * 

WATT:  What  products  -  what  properties  did  it  not  have  that  you  were  looking  for? 

KERR:  It  didn't  have  the  same  discrimination  caoabilities  It  didn't  i™.,  <u„  „„  , ... 

audit  report  and  report  on  configuration  that  we  require.  '  d  “  *  h  sarae  ablht>' to  Provtde  an 

> 

administrative  review.  *  q  d'  “  faCt>  m  that  c™stance  than  they  would  be  in  any  internal 


CANADY;  The  gentleman's  time  has  expired.  Hie  gentleman  will  have 


three  additional  minutes. 


is  youkSo*“S?f^^ 

KERR:  That's  an  area  that's,  in  fact,  in  a  state  of  change  today. 


one  company  or 
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WATT:  Who's  changing  it? 


KERR:  Yon  did,  sir... 


(LAUGHTER) 


...  in  that  the... 


WATT:  I  think  fve  -  you  being  Congress,  I  take  it? 


KERR:  Yes,  sir. 


WATT:  I  think  I  voted  against  this  bill,  as  I  recall,  and  still  have 
you. 


some  concerns  about  it,  to  be  honest  with 


But  go  ahead,  I'm  locked  with  everybody  else  for  that  purpose. 
KERR:  Sorry. 


Some  of  my  colleagues  know  this  better  than  1,  but  the 


point  is,  the  Communications... 


gii°“ld  ^  iireCt“e  ,WS '°  f,rki"so'1'  He's  ,he  8“eral  ““"*1.  He  should  know 

Or  Mr.  DiGregory.  I  didn’t  mean  to  beat  up  os  the  technician  here,  Fm  just... 

DIGREGORY*  In  its  most  basis  sense*  as  I  understand  it*  the  telephone  tap  is  conducted  at  the  nhone 
“JPy  JjJ-1*  resected  to  the  individual  line  which  you  wish  to  tap.  Whether  you  wish  to  obtain 
numbers  dialed,  numbers  commg  m,  or  whether  you  wish  to  obtain  content. 

Si  y°’1  “  h0W  **  «"»«  “«  «»  «P*a»y  that  CarniV'ore  has  for 


DfGREGORY:  Now,  well  go  back  to  the  science  side. 

KERR:  Not  to  tty  to  confuse  you  by  switching  back  and  forth,  but  the  telephone.. 
(CROSSTALK) 

WATT:  Fm  pretty  confused  without  you  switching  back  and  forth,  but  go  ahead. 
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IS  SSrfS  ’***  «  «»  bo*  historic!!* 

intercept.  Ifs  a  so-called  packet-switched  Mwo*  Sn  S.  S'?,0fB’ ttat  “Ve  <0*>g  » 

m  order  to  make  a  phone  call  fom  my  house  to  vorns  lid  £“  if  von  w  i?  r  leas“S  «  circuit 

conversation,  our  private  circuit.  '  ’  n  xm  s>  ”  >ou  w,ll  for  the  time  of  the 

WATT:  Let  me  stop  you  right  them,  because  my  light's  going  to  go  off-  has  already  gone  on. 

(CROSSTALK) 


vi'vjN **> 


fa477 


KERR:  I JI  give  you  my  view  and  then.*. 
(CROSSTALK) 


CANADY:  The  gentleman  has  an  additional  minute. 
KERR: ...  HI  stand  corrected  by  my  colleague. 


belief,  from  my  perspeSl^haUhe  1  ^  rbecause  ofthe  correct 

appropnate  analog  to  the  telephone  number  toKSSSSSt^Si^ **  “  fact’ 8  usefoI 


But  perhaps,  Mr.  Digregory  or  Mr.  Parkinson  would  like  to  add  to  that. 

authority,  and  theS  h?gher°!evel  af  ^dations  of 

the  courts,  depending  on  what  sort  of  fatrusion^ouS  d.a  hl#?r  ]evel  ^authority 

e  to  move  it  up  a  notch  or  several  notches  to  a  Title  III  authority.  d  t0  S°-bW$.*M-then  w 


tn 


WATT:  Thank  you,  Mr.  Chairman. 
CANADY:  Chairman  Hyde? 
HYDE:  Thank  you,  Mr.  Chairman. 


privacy.  And  when  you  see  some  of 
to  wonder  and  to  worry. 
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itSopta  fllf  NeS^S™®1'  Wlicsti™«lh  Mfonmtionthat  was 
later,  mildly  critical  of  what  he  did,Pwhich  doesn't  go  to  h“Cd  roproseS°  “ 1  “m,!t  1,5  8 


A  less  compel i mg  c&sc,  I  case,  is  over  the  so^c&jlcd  Filcfifatc  where.  thf?  wasn^t  iwt*«s4*  a  *  «  v 

ones  sense  of  privacy  was  —  took  a  he^ftna  I  ?imny  *ulLi  a  a  \  ^  v^asn  t  breached  at  all*  but 

ssssr“-^  ** %- -S«s , 

isl^ 

DIGREGORY.  W  ell,  I  think  that  terrorist  cells  arid  organized  crime  can  use  ihr-  i«t i»m «.*  «„  „ 

can  use  e-mail  to  communicate  And  simniv  ib*  WT .nL  7  Hse  , ,  met  t0  communicate, 

i&SSS&qxg  ~ »  -*SSI^S?£he 

are  being  called  by  the  organised  crime  figure  or  iCSS'"8"  “*r’  ,h°S,!  numbers  a,at 
reeled ' >'ol!  h?ve  for  not  letting  the  Internet  sendee  providers  gather  the 

I  doSSs * i  qSattatf  i not  lSg°hem“o  it”! thtak  Carnh-or^mf  “S“/ '' m  "T01?8  ~ 

m, ?4S rS“icott is  ”Mbk  to  «■"*•  *•  5SS»hSS3iffiX 

KERR:  And  let  me  amplify  on  that  a  little  bit. 


Sa£“ fashSdmS  5S>  Wi!1  aIWayS  Si!0W  the  fatemet  service  provider  to  do  it  if  they  can, 


in  fact. 


the  ISP  tried  to  wo™ riSeiS toufem' ratS§ah!fS  to  not  SpSfalffth  *  °d5 

s  ss  ffiSRtga  s^aSKSftr "  w "*• L  ^  £s  £ 

?aiS,n^  ^-eir  first  line*  *n»  first  line  is  to  let  the  Internet  service  orovider  5t  if  „„  *  a  -  * 

he  FBI  i  believe  would  like  the  Internet  service  providers  to  do  it  if  they  can  y  n.  And,  m  fact, 

HYDE:  Fine.  Thank  you  very  much.  I  have  no  more  questions. 

1  iu  through,  Mr*  Chairman, 

CANADY:  The  gentleman  from  Michigan’s  recognized. 
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CONYERS:  Thank  you  very  much. 


I  think  one  of  the  basic  questions  here  is  to  determine  whether  or  not  you’re  minimizing  your  activities  or 
whether  you're  maximizing  them.  And  of  course,  it's  already  been  asserted  that  you're  minimizing  them. 
And  my  job  is  to  find  out,  maybe  before  the  hearing  ends  but  certainly  after  the  hearing,  whether  that  is 
correct. 


And  it  seems  to  me  that  this  system  that  we're  oversighting  today,  unlike  other  trap-and-trace  devices,  or 
the  others'that  we  use,  is  available  for  —  is  subject  to  the  maximization  of  information,  getting  more 
information  than  is  required  or  is  authorized  by  a  court  order.  And  so  that’s  the  area  that,  to  me,  is  verv, 
very  unclear  as  of  now. 


Tm  not  sure  how  we’re  going  to  sort  this  out,  but  1  think  we  have  witnesses  here  that  are  going  to  come 
forward  later  on  that  are  going  to  complain  about  the  fact  that  there  was  other  information  that  was 
available  through  this  system  that  might  not  have  been  available  if we  weren't  going  through  the  Internet. 


CONYERS:  Isn't  that  possible,  that  you  can  get  more  information,  you  can  look  at  other  things  that  would 
not  have  otherwise  been  available? 


KERR:  One  of  the  points,  Mr.  Conyers,  that  I  was  taking  some  time  with  was  to  try  to  make  it  clear  that 
the  only  information  we  can  capture  is,  in  fact,  that  specified  in  the  court  order.  And  to  go  outside  of  the 
court  order,  in  fact,  is  a  federal  felony  with  substantial  sanctions  for  those  who  would  do  so. 


We,  in  fact,  think  of  this  as  a  tool  that's  designed  explicitly  to  meet  the  requirement  of  the  court  order.  We 
don't  have  the  authority,  nor  are  our  people  allowed  the  opportunity,  to  step  outside  of  those  bounds. 


CONYERS:  Well,  right,  that’s  the  law.  But,  I  mean,  that's  the  problem.  1  mean,  if!  could  be  assured  that 
everybody  wouldn’t  do  the  wrong  thing  because  there  was  a  statute  making  it  criminal,  that  would  reduce 
a  lot  of  our  efforts.  And  even  law  enforcement  people,  I  hasten  to  add. 


Mr.  DiGregory? 


DIGREGORY:  Mr,  Conyers,  as  I  understand  the  way  the  system  operates  -  and  certainly,  that’s  correct, 
that’s  what  the  jaw  is.  But  them  are  checks  and  balances  with  respect  to  Carnivore  which  would  make  it 
extremely  difficult  for  someone  to  counter  those  checks  and  balances  and  violate  the  court  order. 


It’s  not  just  a  situation  where,  as  I  understand  it,  a  rogue  FBI  agent,  for  example,  could  broaden  the 
coverage  of  tire  Carnivore  intercept  and  violate  the  court  order.  In  order  to  do  that,  he  wou  ld  need  to 
engage  the  aid  of  technical  people,  perhaps  even  technical  people  at  the  Internet  service  provider,  and  he 
wfould  also  have  to  fmd  some  way  to  cover  up  or  change  the  audit  trail  that  is  left  by  the  system  so  that  it 
doesn't  expose  his  going  beyond  the  court  order. 


And,  again.  I'll  stand  corrected  by  those  who  are  more  expert  in  the  way  tills  system  functions,  but  that’s 
how  I  understand  it.  And  although,  yes,  that’s  the  law,  there  are  checks  and  balances  which  would  make  it 
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three 


my  question  that  you've^venlme  Imowthaf  £^at  die -technological  part  of  the  response 

agencies,  facdJKJS^SSS^Taiih^^ifcSJ^^  JP-*^  WveWn 

hardly  anything  new  about  that.  ’  *  *  g  b  }  ond  the  SC0Pe  of  their  responsibility.  There" 


to 

many 


OK,  it  $  the  government.  And  that’s  what  I'm  not  sure. "  8  U  kCS  evei>oody  believe  that  it  s 

GRAHAM:  Will  the  gentleman  yield? 

CONYERS:  Of  course. 

a  gentleman  raises  a  valid  point,  but  I  think  that  that  has  already  been  addressed  to 

LTo? e'pSs  So* t0  h3V?ihiS  SyStem  *****  by  Sdeptndem  ’ 

representatives  of the'todependent  body^fe^mirts^ould  come^ere  kfth^r  1  W^imatel^ 
that  we  might  have  of  them,  based  on  their  independent  Congress  and  answer  questions 


review. 


h%y/wet>Jexk*nexl 

extremely  difficult  for  someone  to  violate  the  court  order. 

TheSSl^SSU™?  hW  rafora*»‘Pf»"  «*>  wtaap  law. 

prosecute  particularly  law  enfoLment  iffiS^SSteT8  *“  andwoukf 

tel  JtoSintlrc^tions. ^  ^  m  *” the  COatext  ofthese  kMs  of  intercepts,  but  in  the  context  of 

CONYERS:  So  our  assurances  are  that,  first  of  all  there's  a  law  toaino  it  «,n,vk  ., 

prosecute  your  own  people  were  they  to  violate  if  and  that  there  are  other  technnlnoi<^U  ^  aSSlduo.us  y 
make  tt  very  difficult  to  do  anyway.  There’s  a  b<5fi  SSffJSSS  S i^m^asures  &at 
information  than  you  want.  Is  that  the  way  I  understand  that  it  mtS^Dt  K^  ® 

Ihat  which  is  part  of  th?orfc^'to  doi^St  Mtup^diSietoc  i$f  ?tder '?  co,lPct  record 

sstsac  ssf*ST3i^£Ssasif2^r^^3r5^^  -■ 

and  with  an  appropriate  dSrf cmoiy “geTSt"*  “  ‘  S'aW  by  *****  who  is!™«  «*  order 
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CANADY:  Would  the  gentleman  yield  from  questioning? 

CONYERS:  Well,  yes. 

reyiewed  this  systeL  b?dyofe*ferts 

could  change  at  any  time  after  that.  And  how  wood  you  maintain  *  do;et  c®tera>  that 

Jllhnuted  after  they  had  investigated,  unless Was 


31s:  c.hairm!n  c8152^  mere|y  *> 


*  *  ^  c-Vf  W&.  SVil  UX 

it  began  to  take  on  a  life  of  its  own  that  led  to  this  hearing 


about  it  in  the  scope  of  things,  and 


k£.!?T  an>dous  t0  bfar  the  non-government  witnesses  to  see  how  their  nnrff»rcfs,«ftinf,  „r  , 

been  happening  and  -  with  this  system  comports  with  what wfre  E S XK? T I? f  what  has 
anyway;  that  s  what  your  job  is  about,  that’s  what  you're  supposed  to  do  d‘ B*  1  thk  the  w,tnesses» 


Thank  you,  Mr.  Chairman. 


CANADY:  Thank  you,  Mr.  Con  vers. 


Hie  gentleman  from  Arkansas,  Mr.  Hutchins 
HUTCHINSON:  Thank  you,  Mr.  Chairman. 


son,  is  now  recognized  for  five  minutes* 


audit.  I  think  the disputes  thSthe  ISPconSimhy  wouHh'fe  t  C£deS  t0  m  bdependcnt  review  and 
purposes  of  reviewing  it  and  dete^inf^^^ accomphshe^wha^you  des^  ^°r 

Caniivore^Dr  Km?  ^  *** ,f  ^  *°  a!3owhlfi  open  access  {0  the  source  code  that  make  up 

up  to  do  verification  and  vaHdat^^^  to  a  group  set 

iS>  !f  .^ac{*  commercial  off-the-shelf  software,  and  its 

under  the  license  that  we've  mid  for  °PCd  ^  We  re  not  at  hbert>' t0  divulge  their  source  code 


HUTCHiNSON:  So  you  would  be  open,  though,  and  it  would 


ftot  compromise  legitimate  law 
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S£^2“4^#/toa* ”*  a  °°eoi”® rcview  ,ysttm  of ‘he  source  coii's  for  o»x» 


ore  or  any 


OTiew  it  rack iimcmt  'St  if!"  7Cd  taV'  “'  *??e  P0”1  is.  you  know.  “ken  is  enough  enough’  Do  you 
"mml  SSS  sXSLS™'!  '■«?  *Ks»**!e.  Do  you  do  i,  a,  part  Tan 

may  be  S“rV"U“B!  bcyond  slmPly  »»"“*  <**«»•*  when  it's  in  ufo  net 

HUTCHINSON;  Thank  you, 

NoWj  let  me  —  if  you  have  a  content  court  order  to  use  the  OarmvfvrA  . 

show  probable  cause,  you’ve  got  to  get  vour  court  order  Rot  at  2 ?  •’ 1  tbe8» of  ™u,rse’  >'ou  have  to 
information  reviewed  by  Carnivore?  '  But  “  that  P°mt’ !S  inB0Cent  «-party 

KERR:  If  we  have,  in  feet,  gotten  proper  information  on  the  target  addresses  and  the  "to  f ™m»  w , 

which  we  were  aSifeSo recorffd  some{hi«8 }0 
telephone  wiretap.  we  wouiuna\t to  minimize  that  just  as  we  would  on  a  normal 


thSSS  f 1 [a,“? f  r  as  *  piPe  “  which  Carnivore  looks 

mrougn  the  typv  to  seize  that  which  is  the  subject  of  the  court  order. 


cs  at  ail  the  data 


going 


KERR:  Right.  In  fact,  one  of  the... 


HUTCHINSON:  Is  that  pretty  much... 


KERR  ;  Yes,  one  of  our,, 


HUTCHINSON:  The  question... 

KERR: ...  problems  is  that  the  pipes  are  too  big  for  us  to  do  that  and  we  relv  on  .  . , 

give  us  just  part  of  the  traffic  coming  through  their  big  pipe.  y  h  Serv,ce  ?rovjders  to 

HUTCHINSON:  And  Fve  learned  on  computers  that  sometimes  delete  does  not  mean  dew  ft,,, 
information  continues  to  be  stored.  And  so  my  question  is*  Is  the  info™Sn?hS5  i 
to  fee  court  order,  is  it  ever  retrievable  in  any  form  by  any  means’  h  P  *d  pufSU£mt 


KERR:  No,  it's  not,  because  it’s  all  in  random 
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power  goes  off,  we  will  lose  everything  in  that  memory.  None  of  it  gets  to  the... 


HUTCHINSON:  What  if  the  power  doesn't  go  off? 


KERR:  Well,  none  of  it  gets  to  a  stable  recording  medium  like  magnetic  media  in  a  hard  drive  or  a  ZIP 
drive,  a  floppy  disk.  Only  that  which  we're  authorized  and  which  the  filter  is  set  up  for  gets  to  that 
permanent  media. 


HUTCHINSON:  Now,  you  indicated  feat  year  to  date  Carnivore's  been  used  16  times,  I  believe  20  times 
in  all  total  How  many  of  these  -  of  course,  these  are  the  ones  feat's  used  the  Carnivore,  is  feat  correct? 
But  you  also,  in  addition  to  that,  use  court-ordered  wiretaps  or  pen  registers  to  retrieve  Internet 
information  by  using  ISP  capabilities. 


KERR:  In  some  of  the  cases,  we've,  in  fact,  been  able  to  ask  the  ISP  and  they  have  provided  us  the 
information. 


HUTCHINSON:  Pm  trying  to  get  a  contrast.  The  16  that  you  mentioned,  were  these  not  by  using  ISP 
capabilities?  This  5s  when  the  FBI  went  in  and  used  the  Carnivore  system;  is  that  correct? 


KERR:  That's  correct. 


HUTCHINSON:  All  right.  So  I’m  trying  to  get  an  idea  how  many  others  are  out  there  that  were  used  by 
ISP  capabilities. 


KERR:  I  don't  have  fee  number  with  me.  We  could  certainly  provide  feat  to  you. 


HUTCHINSON:  Does  anyone  know  that?  I  mean.  I'm  trying  to  figure  out  if  we're  looking  at  100  others 
versus  16. 


PAINTER:  My  understanding  for  the  Title  HI  intercepts  is  that  it  is  not  a  large  number.  Trap-and-trace,  it 
might  be  a  little  larger.  We  can  try  to  obtain  those... 


(CROSSTALK) 


PAINTER: ...  Dr.  Ken's  indicated  —  provide  it  to  the  committee. 


CANADY:  The  gentleman’s  time's  expired.  Die  gentleman  will  have  three  additional  minutes. 


HUTCHINSON:  Thank  you. 

1  mean,  it  just  strikes  me  that  -- 1  mean,  considering  the  number  of  Title  III  wiretaps  of  telephone 
communications,  I  mean,  that’s  much  greater  than  the  16  or  what  you've  used  by  ISP.  And  I  guess  what 
I'm  leading  to  is  feat  it  looks  like,  if  the  bad  guys  are  moving  as  the  whole  population  is  moving  to  data 
communications  through  fee  Internet,  looks  like  we’re  missing  a  whole  lot  here,  that  we're  really  only  on 
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the  surface  of  what  we  might  need  to  b  e  doing. 


“  maUfc«SpiSCUS!i”8  “  "*  P°i"t  C“r"iVOr<!  has’ ta  f«- 


“molSow  J0i”!'"S  0Ut’  'h?e's  a  'M,of  olher  traflio  on  die  network.  We  continue  to  work 

to  try  to  see  how  we  could  develop  appropriate  and  lawful  tools  to  go  after  that  traffic  as  well 

It  would  tend  again  to  try  to  use  the  properties  of  fee  network  itself;  the  need  for  me  to  be  able  to  move 

bdr£:r^ 

GRAHAM:  Would  the  gentleman  yield? 


HUTCHINSON:  Yes,  I'd  be  happy  to  yield. 


>Wrc  talkfa8  ab0llt  im  not  e’maiL  w>“  realn> 


k^iSiSofdS  T f -ier  PIS°f 1 *S’  for  example,  to  move  large  files,  to  move  imagery,  to  move 
iarger  quantities  of  data.  And  A  wouldn  t  move  as  e-mail  m  the  sense  that  weVe  been  uilkmor  /hrmt  k 

}?U-k:?ow,.'Jrora,n1ei  t0  you.  subject,"  whatever,  it  might  just  move  as  a  block  of  data  If 


01  m  fact>  ^formation  that  companies  are  moving  from  one  location  to  another. 


HUTCHINSON;  Have  you  ever  had  a 
court  order? 


an  occasion  to  try  to  retrieve  any  of  that  information  pursuant  1 


SSiitflnhin  of0t  hf1 any  $5**®?°  tbat  Vm  aware  of  where  we’ve  tried  to  intercept  that  kind  of 
probably  be  pic t0  ^ *  "*  S°mepkcC  8“d  We  would 

SpedM;ttes^ 

But  this  is  still  a  concern.  I  press  that  even  the  "to"  with  fee  address,  sometimes  a  descriptive  term  ~  do 

“  have  you* m  fact>  fr°m  your  history  of  the  16  instances  that  Carnivore’s  been  used  Svear 

^  h^i  m- 5 ?  M»™*T that  you  beHeved  y°«  needed  pLuW 
minimize  It?1  ?yP  capture,  that  you  believed  might  go  into  fee  content  area  and  therefore  you  had  to 


CANADY:  The  gentleman  —  the  gentleman.. 
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HUTCHINSON:  I’ll  just  finish  this  and  then  HI  be  done. 

CANADY:  Yes.  The  gentleman's  time  is  expired.  The  gentleman  will  have  one  additional 


minute. 


KERR:  I'll  reserve  the  opportunity  to  answer  carefully  after  review,  but  there  are  none  to  my  knowledge. 

HUTCHINSON:  So  in  other  words,  you're  saying  the  system's  working.  You're  not  caeturine  content 
information  beyond  that  which  is  intended  undefthe  court  order.  capturing  content 


minutes. 


KERR:  That's  correct. 


HUTCHINSON:  Thank  you,  gentlemen.  I  yield  back. 

CANADY:  Thank  you,  Mr.  Hutchinson. 

The  gentleman  from  New  York,  Mr,  Nadier,  is  recognized  for  five 
NADLER:  Thank  you,  Mr,  Chairman. 


foehearkg.lf  ^  m  question  that  may  be  rePe{isive  S!nce,  because  of  a  plane  delay,  I  arrived  late  i 

tnl  un<bsrstand  ll’  Carnivore  can  be  used  either  for  content  or  for,  in  effect,  a  trap-and-trace  ins!  tn 
know  who  an  e-mail  —  who  a  person  is  communicating  with;  is  that  true?  *  ^ 

KERR;  Yes,  that's  correct 

NADLER:  So  it  can  be  used  for  cither  purpose? 

KERR:  Yes* 

NADLER:  Or  both. 

And  whether  it's  used  for  either  purpose  depends  on  the  nature  of  the  court  order 


KERR:  That's  also  correct 


NADLER:  And  it  can  be  set  either  i 
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KJERR:  It  s,  in  fact,  set  specifically  to  meet  the  terms  of  the  court  order. 

“K^tag?^1  traP-“!|-,ra“  y°“  10  ta0"'  «*»  *»«>*  is  talking  to; 

*'  ,rap-Md-,raCe  mi  ***&«*  “**• «« >»  »<■  from 
N5* no’ IS  d  P3St  te®se?  You  get  a  court  order,  we  want  to  know  who  this  guv  talked  to  in  the 

last  two  months  or  we  want  to  know  who  he's  talking  to  in  the  next  two  months? 

KERR:  It's  prospective. 


6fa477 


.  talking  to  and  sometimes  what’s  being  said  if  it’s,  if  they’re  both  prospective? 

KERR;  I'll  let  ray  colleague  lead  with  that  one  please. 

vISS??SX:  ^  depeadv  Vp?n  nature  of  the  Information  that  you  have  available  to  you  at  the  ..... 

order  to  estahlkblhfn11^  ^ormatIon  at  *be  {ime  *bat  you  seek  the  pen-register  or  the  trap-  and-trace 
order  to  establish  the  probable  cause  necessary  to  seek  the  order  **  the  Title  01  order  for  the 


time. 


s  content. 

Sp^and^ace?  ^°U  bave  en0lis!l  t0  ”  '>ou  need  a  !esser  standard  of  probable  cause  to  get  a 

mS^S?^mRiS  n0t  S  prj3kab!e  Causr  standard  at  ali»  il*s  simply  a  certification  to  the  court  by  the 
Seh  Se  ofTe  he  2W  ef°/cement  3|enc>' that  the  information  that  will  be  obtamed 
crimlai  fovestigat  on  ?  »ap-and-trace  -  or  the  trap-and-trace  is  relevant  to  an  ongoing 


N ADLER:  With  no  probable  cause? 

DIGREOORY:  With  no  probable  cause, 

NADLER:  So  you  can  get  it  on  anybody  with  no  probable  cause? 


SSdlfS  EES  {fi0int  OUt  t0  you  Mim  ~ that  the  Supreme  Court  held,  in 

„r  i  '  s*  braith,  I  believe,  ra  1 979,  that  there  was  no  reasonable  expectation  of  orivaev  in  numbers 

fefio^m ^olSTSev6 SS??' f  aIIy’Then  S0[f.eon.e  «*“»  over  information  to  a  third  party  like  the 
pritSy  tSforSSon  W  ^  ei£hef  3  sub->ecl!ve  or  an  objective  reasonable  expectation  of 
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wifeout  any  probable  cause,  who  is  sending  me  mail  or  whom  I’m  sending  mail  to? 

DIGREGORY:  We  do  mail  covers  all  the  time,  which  essentially  do  that, 

NADLER;  Without  probable  cause? 

DIGREGORY;  That's  right. 

NADLER:  Thai's  very  interesting. 

Let  me  ask  you  a  different  question. 

codiliedat  fig  Ujhte/ilates'codT  fbdieveif  s  ^25^nhY  Vh  authority  Jflder  which  we  operate  is 
oulws  ^oae»  *  Deliev  e  tt  s  _G  -2,5  <ph)  with  respect  to  the  pen  -  or  3 1  -23  (ph). 


NADLER:  Thirty  -one-twenty,.. 


DIGREGORY:  Twenty-one  ~  31-2 1  at  sect,  which  includes  23, 25, 1  believe. 

NADLER:  OK.  Now,  let  me  ask  you  a  different  question.  You  installed  -  vou  started 

Carnivore  system  about  two  years  ago.  and  no  one  ever  bothered  tdtmn  rted  usa^»  this^ 

out  about  it  because  Earthlink  complained  about  it!  d  * 8  C  gress  afaout  lt;  we  Just  found 


.telling  Co?gress  ta  u»  of  all  of  Congrm.  There 
memocrs  ana  staff  briefed  on  it  over  the  last  year.  It’s  been  widely... 


certainly  have 


NADLER:  Judiciary  Committee  staff? 


KERR:  Excuse  me? 


NADLER:  Judiciary  Committee  staff? 


Department  of  Justice,  including  at  the  training  center  in  pnh  e  *  bnefed  within  the 

a«on,cys  «!  AUSAs  8o  for«J,tas.  AuS^jS 2£^5S2SaSftffi“ 


5/24/02  Retease-  Pa 

U/QtM  J 'M  '?  n 


f  lexis<&.nexis® 


-  -XS; 


JiKj>^Avcl)icx  b-nexisxom/fo.unJ. 


‘^v'^VV ‘,  *.'• 


N)bcf305a45 1 7927«Sfce72f5  Jsfc«77 


SSwt’intw0 1116  °fi’Ce  ?f Enforcement  Operations  in  the  Department  of  Justice  where  it's  m  fact 
renewed  pnor  to  ever  going  to  a  court  to  get  a  court  order.  So  there’s  a  very  substantia!  level  of  review 

issued  ’  3  t0  department’ as  welJ  as  the  -^sequent  review  of  the  court  before  m 


N ADLER:  Subsequent  review  to  foe  court?  I'm  sorry. 


i  think  I  asked,  once  you  have  Carnivore  on-line,  what  institutional  safeguards  do  we  have  that 
misused?00  gathered  hy  Carn{vorc,  presumably  afier  the  court  issues  an  order  to  install  if,  is  not 


CANADY:  Die  gentleman’s  time  has  expired.  Die  gentleman  will  have  three  additional  minutes. 
NADLER:  Thank  you. 


ttat  %  '5at'  5OTic“!>rt5'  i”  *  Ml-  content  intercept,  that  the  infonnalion  we 
iS'SlowSfhe’orE  "  SMl  ^ lhC  '°m'  Whi£l’  C“  <ha.  weVe 


NADLER:  It’s  provided  back  under  seal  to  the  court  ? 
KERR:  Correct. 


NADLER:  Is  there  a  proceeding  in  the  court? 
KERR:  I  don’t  know. 


fookaUL  * me2n>  ^^Cre 8  not  8  ProceeMng  *n  the  C0Uft> MU  simply  be  placed  in  storage,  no  one  will 

PAINTER.  That  s  not  completely  true,  because  it’s  placed  under  sea!  with  foe  court  In  sk#.  T'lti.a  itt  «nnf  , 
intercept  And  then  at  some  time  in  foe  future,  the  court  can,  under  Tide  nr  mSShTt  avaSStfo TJ 
instance,  foe  person  whose  conversations  were  intercepted  and/or  his  defense  counsel.  ’ 


fateSSlPe?  ”  iff  pffn,has  be?n  the  SltbJect  0f  such  30  order  ««*  Ms  content  has  been 
imerceptea  or  simply  —  or  simply  that  whoever  he  was  bw  tn  _ it  „  rMr»* 


*  that  his  pri  vacy  was  so  violated? 


o^SteiSj»tlfar“^rViSir  f Tii!e.  'LV ifa  Title  m  «*f  &  bv  the  judge 

«,w“  -er  a  curtain  penod  of  tune  - 1  believe  it’s  90  days  -  there  has  to  be  notice  to  foe  people 


^  ucutvc  yv  uays  mere  nas  to  be*  * infirm*  t*>  t 

conversations  were  intercepted.  I  think  that’s  been  done  very  broadly,  as  I  understand  it. 


i  of  76 
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S^LSv»Sj'oi B®  co"venatio»s  w«  i»<«epted  or  whose  —  or  on  whose 


e-mail  there  was  a 


PAINTER:  Unto  rhe  provisions  of  Title  III,  when  you're  dealing  with  content,  yes,  that's  coned, 
^rf5a«o  Wh“  ab°U<  **“  yoa'a  not  dealto«  »*>  «”<«*.  «*'"  .volte  dealing  with  a 

^SmpiStace'Se  Mw?Sob,Hf  LSl,°“'d  ™Phasi.ze  southing  that  Mr,  DiQregory  said 

invediWtivesV^ 

(CROSSTALK) 

donemSg  “onetuf  S  “  Pr9taMP.  «“*  <°  <*«'ve  that  IVe  committed  a 

to  by  e-mail  or  for  that matter*’™  E5  £”  y0“  hav?  foll»wcl?  «*»  tm  talking 


privacy  was  violated  in  that  way?  Do  l  ever  know  fbout IS  g <t°y°- ever  tell  me  that  my 

Hin  !  <*on,t  bebeve  tbat  tbere  55  any  requirement  for  disclosure  in  the  law  And  I  would  nnJv 

LwSt&raS?e  tena  Wthatr  privac>: was  " 

to  make  'Jb^S^SS^  *******  of  privacy  in  such  inforaJL  I  just  wanted 

^Snfof  piwabnt  1 1S  'PTe  fQUrt'S  P°int  ofview> th2t  here’s  no  reasonable 

rttioiri  th  ,  01  p  a  i’ bu! 1  tbmP  as  a practical  matter,  most  people  would  be  somewhnf  mwt  ;c 


to  know,  Ithink  I  should  know  Shat S ilSd nS“T '  dM”'t  w“  •’“l”' 
basis  did  you  do  this?  Did  vou  have  mv mmn  t a  ]!«  be ,ab  5 to  t0  tbe government,  On  what 

right  now,  there’s  no  provision  forthS*  *°  d° it?  And  maybe  thc-v  did  and  maybe -they  didn’t.  But 

PAINTER:  Well,  that  they  *-  first  of  all,  the  prosecutor  has  to  certify  to  the  court  that  u  ;*  -»!«»»  ♦ , 

NADLER:  What  period  is  it  limited  to? 

PAINTER: ...  is  60  days. 

NADLER:  Can  it  he  renewed? 
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PAINTER:  It  can  be  renewed,  but  it  has  to  go  back  to  court. 

NADLER:  How  often  can  it  be  renewed? 

PAINTER:  I'm  not  sure  there  is  a  limitation. 

NADLER:  What's  the  longest  anyone  has  ever  been  subject  to  this? 
PAINTER:  We'd  have  to  look  into  that  to  be  sure. 

NADLER:  Has  anyone  ever  been  subject  for  more  than,  let's  say,  a  year? 


PAINTER:  Again,  I  don't  have  that  information  available  at  this 
NADLER:  Five  years?  Could  you  rule  that  out? 


point. 


KSfcSrf  If n do  alffl'S  T ,0  P1"  0S‘ ,he  ,0"8esl  «»*  «ta  anybody  las  eve 

J  HM,  we  can  try  to  do  that.  I  don  t  know  if  we  have  those  records,  but  we  can  try  to  do  that. 


NADLER:  Thank  you,  Mr,  Chairman. 

CANADY :  Thank  you. 

The  gentleman  from  Alabama  is  recognized  for  five  minutes. 


BACHUS:  Thank  you. 


Die  potential  for  abuse  here  is  tremendous.  Would  you  all  agree? 

PARKINSON:  Congressman,  I  guess  I  don't  agree  with  that, 

BACHUS:  All  right.  And  you  don't  have  to  give  an  explanation. 

PARKINSON:  Well,  I  think  at  a  certain  point  in  time  we  have  to  relv  nn 

who  are  -  who  have  a  number  of  ,1  -  I  y  013  the  Sood  With  of  pubhc  servants 

ne  nav  e  a  number  ot  checks  and  balances  m  case  they  get  try  to  get  away  with  something. 

BACHUS:  1  think  you're  exactly  right.  I  think  what  you’re  saying  is,  trust  us.  You  have  to  rely  on  us. 
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reij  «  -  ySa% have  taldfon fe1"’”' ! lhW!  ?ouV  n’f>l- I  think  you  have  to 

to  analyze  .11  the  phone  calls  that  come  thio^Sr'^^?^S1»'mT  "d  ^ ' Wre  S<™8 

KERR;  Tliat's  correct  We  can’t  do  that, 

BACHUS:  But  you  can  do  that  with  this  -  with  Carnivore,  with.,. 

KERR:  No,  we,  in  fact,  specifically  don't  do  that.  We  only.,. 

through  that  Monnation^reatMon?  you?  **  ”  °f  5  °U  d°  have  the  abi?lty  t0  anal>'ze  everything  coming 
KERR:  No.  We,  in  fact,  restrict  what  we... 

BACHUS:  Now,  you  restrict  it.  But  you  have  the  ability  to  monitor... 

“dftafoSort  We  d0°‘t  have  •  mm  *“• the  “Pa»®y  10  do  the  real-time  processing  of  that 

V 

system.  I  mean!  yw  don!  just  cap?lire  whatever  you  want  on  that 

KERR:  We  don't  have  the  right  nor  the  ability  to  just  go  fishing. 

BACHUS:  Well,  you  have  tire  ability'  to  monitor  anything  within  that  information  stream. 

KERR:  No,  we,  in  fact,  have  the  lawful  opportunity  to... 

(CROSSTALK) 

BACHUS;  No,  I  said  you  have  the  ability... 

KERR; ...  some  very'  specific  information.., 

haw  te?ecta’o"ogy  <o  Si St  taVC  le*al  ability- Bw  )™“ 
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KERR:  We  are  not  sitting  looking  at  the  information  stream  and 
m  place  with  a  court  order.  It's  not  intended.. . 


moving  our  filter  around.  It’s,  in  fact,  put 


huVt tschnoIo8>'  to  go  in  and  monitor  every  one  of  those  e-mails  on  the  system  if 
you  wanted  to.  Not  all  of  them  at  once,  but  you  could  just  -  you  could  monitor  here,  you  could  monitor  ? 


there... 


KERR:  Certainly,  if  you  had  access  to  the  system,  in  principle,  you  could  do  that. 

BACHUS:  Which  you  do  —  and  you  can’t  with  telephone  calls, 

you  “e  fa  ,he  tti'pht,"e  sys"m  and  <*  < *w*ch 

BACKUS:  So,  you... 

wdf^nd  SIP  ton  Sttthnetn3'me  thIn8'  ReroCn£er’  **»*»«  telephone  switches  are  simply  computers 
wen,  and  so  u  you  got  into  one,  you  presumably  could  see  a  lot  of  traffic.  *  3  ‘ 

BACHUS:  OK. 

KERR:  The  fact  is  that  there  are  a  lot  of  bars  to  our  doing  that,  starting  with  the  law. 

BACHUS:  Safeguards.  They're  safeguards. 

KERR:  What? 

BACHUS:  They're  safeguards.  They’re  safeguards. 

KERR:  It's  the  law.  It's  illegal  to  do  that 

BACHUS:  The  law.  OK.  I  mean,  it’s  the  law.  That’s  one  of  the  checks  and  balances  and  safeguards. 
KERR:  Correct. 

BACHUS:  Now,  one  of  those  was,  you  said,  the  Justice  Department.  You  have  to  eo  to  the  Justice 

Department  for -and  notify  them  and  get  their  approval.  go  to  the  Justice 

S  ^  tha‘  “  “k'S  *  Weter  1<Ml  of  aulhori,i's  th«£  1»  approval  for  yoor  activities;  is  that 


you’re 
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KI2RR.  What  Mr,  Parkinson  was  saying  is  that  for  the  trap-and«  trace  and  pen-register  whirh  t\r\Ur 

addressing  mformation,  ifs  a  different  level  of  review  but  to  pet  content  wW  nrfktki  h  y  1Uows 
be  demonstrated,..  w  ■  content  w here  probable  cause  needs  to 

BACHUh:  V  on  have  to  go  higher  up. 

™R'' its  ^  f3Ct‘ takeS  higWevcI  aPProval  in  the  Justice  Department  before  we  are  ever  able  to  go  to  the 


BACHUS.  Well,  let  me  ask  you  this:  Why  did  Janet  Reno  not  know  about  this  although  it1 
three  years,  and  she  is,  in  fact,  the  attorney  general?  m*' al&ough  1{ 


s  going  on  for 


KERR:  Well,  I  would  remind  you  that  the  Department  of  Justice  is  some  127,000  people... 


BACHUS:  OK. 


KERR: ...  and  multiple  investigations. 


have!108'  N°’ 1  thlnk  “  1  tha,'S  a  valid  po'mt  There  are  52  W  people  over  there,  and  we  might 

(CROSSTALK) 

DIGREGORY:  to  ensure  that  we're  balancing  privacy  and  law  enforcement  needs  Sn^  t  *j,  .< 
what’s  going  to  happen  with  respect  to  this  independent  nteds’  and  1  ihmk  {hst  s 

BACHUS:  So  she  didn’t  about  the... 

DIGREGORY: ...  verification  and  validation. 

CoS^aSiftlS  fh?v  °T  mf  ?sfadH that  **»  National  Security  Council  testified  before 
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SSwolemem  ^Tere^S°famS  ***’<  fr°m  tim1t0  !|me«  appropriately  share  information 
»  ,nlf-  *  1  ,e  r?* U1  fact» some  very  important  hurdles  there,  including  the  Classifier! 
y®5fon  Protection  Act  and  others,  so  that,  in  fact,  the  primary  purpose  of  a  system  may  have  been 

ab<2 IcSreSeVcommftS1?  X ^at P™^A PurPose> * ma>' &*ve collected importantinfonnation 
ut  a  cnme,  either  committed  or  being  planned,  and  there  are  mechanisms  to  take  advantage  of  that. 

^  gentlem£m’s  tiroe  is  exPired-  Without  objection,  the  gentleman  will  have  three  additional 

*•  ***  D10”i,0r  -  U,'y  ca"  mon,w  a"  ««*.  «H  e-mails,  all 

PARKINSON;  I  think  we  should  defer  to  the  National  Security  Agency  to  talk  oreciselv  about  F-Yh^i™-,  i 
don't  think  we're  prepared  to  talk  about  it  today.  }  precisei)  about  Echelon,  I 

BACHUS:  I  guess  I  would  just  ask  the  FBI.  They  do  share  -  you  say  they  -  when  he  said  thev  mnfinoSv 
s  ared  mformatton  with  law  enforcement  agencies,  do  they  share  information  with  the  FBI?  * 

W*  have,  as  you  probably  know,  a  very  significant  national  security  responsibility  in 
ia%£  enforcement.  So  it  not  uncommon  at  all  for  foe  National  Security  Agency  to  selectively 

ssssi issssaf  -  * may  ac,uire- Bot  *  d°B  s°-  -  *>• 

teSSial  S*v “c^ul  f^T1  P0if  M  ffl®  *i us.' r“>"< and  .haft  -  you  say 

me  fsationai  security  Council.  I  think  we  all  presume  they  re  dealing  with  national  security  Rut  ti,i„  ,t,„„ 
gam  mfonnation  on  another  subject.  I  mean,  if  it's  national  security, “obviousMhey  could  share  intdtf  Y 
Sme®  f itf  *  S3y  ^  SUbjeCl  °r  lefsjust  Sa>’ that  we're  taring 


DIGREGORY:  Carnivore. 


?^^lkC*r?lL0retSiC‘  -  w  examPles  y°u  gave  us  were  about  espionage  or  terrorism  But  do 

nf  aiitttrust  investigation?  Would  you  use  it  in  income  tax  evasion  cases?  Can  it  be  used 

,  y,  OSHA  investigations,  or  EPA  violations?  Are  there  any  restrictions  there?  * 

Pti^yAcL^  °fC°UrSe’ haVC  t0  be  a  fedmI  felooy  to  come  «nder  Electronic  Communications 


BACHUS:  And  all  those  are ... 


Sirities  4  k  W0UM  haVe  t0  be’ in  fact’ one  °Plhe  predicate  offenses  under  Title  III 


to  come  under  those 


So,  no,  it's  not  every  offense.  Clearly  Internet  fraud  would  be  an  appropriate  tarset  rhifH  „„ 

the  Internet  would  be  an  appropriate  target.  These  are  major  programs  \vifofo the  FBI  thffo 0m0grB?h>  on 


we  would... 
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(CROSSTALK) 


ta»CSS?Sf  0,her  ,ha"  e-mail'  c“  S*  *"•«  Hte?  Can  yon  -  do  you  have  <he  ability 


to  get 


protocol  that's  “mg  SployS  y  **  “  wha‘ M  hav*  te  address«  <*  the 


»iS:SbSy°U  ha',e  and  <b'  pa$!words'  y°"  oooM  “““'iy  get  into  maybe  a  mainframe , 


S  «  ^“&“fS'hetol.fc  ““  °rfCr  SayS'  "'S  "  *  of  I So!”e  ““  *** 


WATT:  Will  the  gentleman  yield  for  a  second? 

SoSd  hym  hail the S3St?an^Vetflready  b-een  {ransmitted?  5f>'°«  had  the  address,  would  you  - 
or  look  at  the  ?  d  V1  capacity  to  go  m  and  either  look  at  the  content  of  a  pnor  e-mail 

or  look  at  the  number  or  instances  »n  winch  there  has  been  communication  to  deliver  that  eiK 

CANADY:  7116  gentleman's  time  has  expired.  The  gentleman  will  have  one  additional  minute. 
BACHUS:  Thank  you. 


Let  me  -  after  he  answers  it,  may  I  have 


my  minute  then? 


KERR,  Shall  I.  try  to  answer  Mr.  Watt's  question? 
BACHUS:  Answer  his,  yes. 


Seadv  heen'Snf^n?"0**6  s{stera  Jasical5>'  deals  with  message  traffic  on  the  fly.  If  the  messages  have 
already  been  sent  and  received,  another  way  we,  for  example,  might  get  it  would  be  if  for  T 

^&ss:=5».ss"-^ 


search  warrant 


DIQREGORY;  And  under  certain  circumstances,  stored  communication  c  that  i,„m  ,  j 
communications  held  by  ISPs  can  be  obtained  b)!  sS  “SntTS  " 8,ored 
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BACHUS:  All  right.  Here’s  my  final  minute.  You  mentioned... 

CANADY:  Hie  gentleman  will  have  one  additional  minute, 

?!  Jk!.  rr;ent1i?ned  judida5  oversight.  And,  Dr.  Keir,  you  mentioned  that  you've  got  the  defense 
attorney  and  he  s  looking  over  our  shoulders:  vou  have  the  »«?«>  w«  _L.., j  .  ns.e 


you  do,  -  y  *  15  3  Prett-V  Potem  weapon  in  limiting  what 

^lhffarf°a  y°% 311  l^fse  03365  are  onSoing  criminal  cases  in  court  where  there 

is,  m  tact,  a  defense  attorney?  Or  could  it  be  -  what  about  a  case  of  an  investigation  where  tww. 
attorney  or  not  active  court  case?  investigation  wnere  them  s  no 

KERR:  I  think  Mr.  DiGregory  pointed... 

BACHUS:  Or  can  it  be  used  in  those  cases? 

2;^  Provisions  of  Title  HI  that  would  lead  to  judicial  notice  of  those  who  had  been 
intercepted.  They  certainly,  at  that  60-  or  90-dav  point,  having  been  informed  that  their 
W^mtercepnsd  would  take  a  great  interest,  Wh 

is  oriented  very  well  to  protect  their  privacy  and  rights.  *  me  s>  stem 

BACHUS.  Are  you  unable  to  take  information  you  gain  from  these  investigations  and  nass  them  r>n  m 
other  law  enforcement  agencies  about  unrelated  investigations?  Or  is  that  information  off  limhS 

ri^^^nwnldi0' Sf0ny’  ?e  Sen?\eman*s/.ime  has  expired.  The  gentleman's  had  more 
, naa  an3,one  eJse*  We  re  going  to  go  to  —  we  have  a  limited  amount  of  time  The  memhere  Afth* 

entme?toShis  ff” qUeStl0n  about  other  thin&s  the  gentleman  might  want  to  ask,  but  Mr.  Barr's 
So  Mr.  Barr  Is  recognized, 

BARR:  Thank  you,  Mr.  Chairman. 

SfA!lr!?&?Uite/aScin3tin8‘ Th?  CHi?!on  administration  is  fascinating.  It  never  ceases  to  amaze  me. 
Committee,  we’ve  been  Cvteg !  a  series  ofhearingj^^^^ 
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thefelrefanctfons  S  Title' XVTH  fn !  ^  ^rW/  because  there  is  a  privacy  act  or  simply  because 
mere  are  sanctions  in  Title  XVffi  for  misuse  of  the  Title  III  provisions  does  not  guarantee  ibfn.w  ■ 

this  or  any  other  administration  will  abuse  it.  So  I  think  we  reallv  need  a  little  bi?  more  than  simnt  Svin 
that  there  are  provisions  in  the  code.  "  n  re  inan  sinW  saymg 

USemtS  IthdSfiS TTl  pr?!ems> but  lhe fact  oflhe  niatter  is  Carnivore  is  not 
a  * s  ^  ?€re  a  &asket  and  these  e-mails  just  sort  of  drop  into  it  It  is  vew 

orier  »  puU  ££££ IS™**  i”  ,ta' BP  i» 

SS 

differed toSSSST  *d  1*"  re*is“r-  y°“'"  **>*  «™»»g  v«y 


ordel  -  e  anted  thePth^S  iPf  "ff S  Wl£b  phone  ^bers,  as  you  all  have  testified,  you  get  an 

from  a  cfurt  if 13  5y  !ower  than  a  TltIe  m  ««*  we  understand  that  ~  you  get  that 

mom  a  court  -  a  court  has  to  grant  it,  there’s  no  discretion  for  the  court  -  and  the  felenhone  rnmnt!  ! 
it  were,  has  to  comolv  with  it  Thev  can't  sav  ,i1P„  •  ,  ,  ana  me  ses te pnone  company,  as 

,  *  ,  “ /  „  ,  u*  cam  sa}  --  tney  can  t  just,  you  know,  give  you  the  hlvh-hnt  sod  «« 

W  e  re  not  going  to  do,  they  have  to  comply  with  it.  And  v™,  id!  JtJ  ,L.  5at. .  y> 


under  the  statute  to  do  that.  Y^  re  doing  something  veiy,  very' {Afferent  hCT*e!*'eC3USe  STt  re^U*red 

Wiat  you’re  doing  here  is,  you’re  going  to  that  ISP  provider,  which  stands  in  the  shoes  of  the  tradin'™*! 
phone  company  when  you’re  looking  at  a  traditional  hard  number  trap-and-tmee  or  oen  renktir  tnd 

m°formSn8We  dS  sa.tlsfied ^hat  thc  £$atute  says  that  you  have  to  install  this  and  give  usfte 
SIS  St^tl  •  f  y?U- 1  dont  kno.w  wh>'  -vou-  y°u  faiow,  what  your  rationale  is  but  you’re 

force iJolnow  f  d°  “*£*"  g-0mg  t0  §0  outside  of  the  Iaw  here,  basically,  and  weVe  going  to 

torce  you  to  allow  us  to  put  our  software  into  your  system.  You  will  not  be  able  to  monitor  it  nv  &  *° 

ghSffcL^SUPderVIm  d3Ild  Utre  th£n  8°ing  t0  ta^e  i{  from  lhere-  ^nk  you  very  much  guys'  you  iust 
give  us  access  and  well  do  our  thins  ThatV  v«v  d;fW.nt  ,  J  \  *  itiUWJ,  guy  s,  you  just 

work  under  the  t^dhiomlChapm  206  schme  h"  ***  {r8P’and-trace  «*  pen  registers 

Also  -  1  think  also,  there  is  new  legal  ground  that  you  all  are  trying  to  break  here  and  «♦ -uit-v, ,{ 
large  guantities  of  infomjon  STou'h fitaHS  ^  “  8°  ”  8"d' Sort  of'  harv«< 

I  think  those  arc  two  very,  very  large  steps  that  we're  taking  here,  i  don't  think  this  has  been  i  j 

out.  And  that- a  two  areas  that  l  have  concern  about.  Why  is  it  not  sufSent “ Ksc  SSl ^ 
tesfimonv.  as  we  ac  %  nnmW  j:  — ~  i. *  a  ViriU  because  we  nave  both 


much  ~  in  A  o  ^  zr  V  V  imn§ imi  carnivore  does,  but  do  it  in  a 

a  y  *****  ls  mmh  more  Protective  ot  the  privacy  of  the  Internet  service  provider  users, 

s“S4SSa^  wre  no*  caPable  of  d™8  ”d  t  *>"'  think  that's  the  case,  then  you  could  siS 
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is  it,  m  both  of  these  areas,  you're  trying  to  break  new  legal  ground? 
o£S  SL  te  tha‘ y0U  d0"'' ,Ute  ab0“(  ,he  “ “"S  Matott  *>>«  willing  to 

r —*  — w*« «« 

/  p  C0U1£S  not  provide  the  formation,  and  Dr.  Kerr  can  talk  about  this  as  well, 
of  them  saying,  Weil,  we  have  to  comply  with  a  court  order  Thfv  *  ,J’ lt  "asat  Jus* s  matter 

»<!  the  court  orferSL  'ha‘  W““Se'1 "  *“  "***  "*>  K«  coon 

33A.RR:  And  that  was  not  the  Earthlink  case? 


PAINTER:  Again,  since  that  was 
service  provider... 


an  ongoing  criminal  case,  I  don't  want  to  mention  who  the  Internet 


reported  in  the  newspaperfi^  And* I !,^a?llIud£  cas£  because  ^afs  been 

case.  8reat  GarK  secref*  A»o  1  *»*  you  are  describing  the  Earthlink 

4 

proceedkg,3 1 4^  w^”b^^itV^^Sfer‘S?1  proceeding,  there  is  a  court  order  in  that 

were  argued  at  the  hearing,  but  l  don't  want  to  mSfe  **  public  facts  ihat 

BARR:  1  thought  you  said  at  the  beginning  it  wasn’t  the  Earthlink  case. 

PAINTER:  i  did  not  say  that,  f  said  1  don't  want  to...  .  . ... ,  .. 

(CROSSTALK) 

BARR:  I  think  it  is. 

PAINTER:  But  in  fact... 
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that  effect  tliat  was  presented  to  the  court  in  the  form  of  affida  vits... 

(CROSSTALK) 

BARR;  But  that’s  very  different  from  tire  testimony  that  we’ve  had  from  Earthlink. 

prff!S  « ,Vs  cert^y th^  policy,  as  I  understand,  at  the  FBI  and  the 

fashion,  that’s  what  they^  prefer.  It  rnhSm^ of! eSfiT^  **  mform*tion  and  do  a  <Ny 

?M^T£utes.nt!emaiI,S  timC  baS  eXpired‘  Without  obiection> the  gentleman  will  have  three 
BARR:  71}  auk  you. 


iw  IT  S7ing’  **?’.  th,at  in  cvery  one  ofthe  25  cases  in  which  Carnivore  has  been  »«*!  sb*  , 
hat  it  has  been  used  is  the  Internet  service  provider  has  toM  w»,  ib^,  JJLTlTfTTT'  **  onl>’ reason 
you  need? 


told  jou  they  cannot  provide  the  information  that 


PAINTER:  That  is  my  understanding,  and  I  defer  to  Dr.  Kerr  to  also  address  that, 
provider  can,  mfcmsSn  to  w-. wverS'b  "fee^urt1 Sder^feat  that’ 


by  bringing  in  our  Carnivore  system  and  employing  it.  ?  P  ed  to  take  fee  technical  and  cost  nsk  away 

SeSXifySolS  advocate's 

"Please  install  Carnivore"?  i  don't  think  so  ’  J  e  IbPs  breaking  down  your  door  and  saying, 


!  install  Carnivore"?  I  don’t  think  so. 


as I  umieraairi  ft,  LStXSShoriCl,ftfe“oramM  SSapSrideToM'S|C“T?Mly  pe"di“8 

SfKR* *  ttleco”mnmiMtlMK  fm-  “d  ’««  -  cveoC y« 2S£5S5S£t «  wta, 
SvSs' ^sr*  ^ chap,w  2°6'  >*» « «■« 

exactly  what  you  want  and  that’s  all  that  vou  cet  §  *“*  hea  fiter  11  out;  >'ou  teI!  somebody 


DIGREGORY:  In  the  case  to  which  -  in  the  case  refemed  to  by  Mr.  Painter 


we  successfully  relied  upon 


tef?<S 
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the  pen-register  statute.  And  know  of  **  and  I  stand  corrected  if  someone  has  a  correction  to  make  -  and  t 
know  of  no  other  case  where  an  ISP  has  challenged  our  reliance  on  that  statute, 

BARR:  No,  but  is  -  what  I'm  saying  is,  is  there  any  statute  or  case  law  other  than  this  one  case  that  as  I 
understand  it  is  still  in  litigation? 

DIGREGORY:  And  I'm  saying  we've  relied  on  the  pen-register  statute  successfully  in  (his  area... 

(CROSSTALK) 

/ 

BARR:  So  you  —  the  Department  of  Justice... 

(CROSSTALK) 

DIGREGORY: ...  and  there  have  been  no  other  challenges  other  than  the  one  mentioned  by  Mr.  Painter. 

BARR:  The  Department  of  Justice  position  is  that  Chapter  206  provides  statutory',  therefore,  also 
SSJJSS®*1  ^onty,  I  guess  you  would  argue,  that  you  had  --  that  the  government  has  the  authority  ** 
£ke  SietogeS Si?'  “eg0'5'  otmtormati',rl- beyond  simply  Up  large.,  mi  then  taelf 


CANADY:  The  gentleman's  time  has  expired.  Die  gentleman  will  have  one  additional 


minute. 


PAINTER:  I  think  when  you  use  the  term  harvest,  you're  using  a  term  that  really  doesn't  apply  here. 
2ow  and  ««  Ste  m^aS'K“"8’ "  fa ' “"ly  ‘he  aP«ciflcalIy  ,ha.  you 

55  it0rder  1  mean> {his  is  S0£t  of  -  *afs  what  I  love  about  the  Clinton  administration,  then 
you  get  mto  this  circular  argument, «  s  almost  metaphysical.  You  have  to  have  some  wav  of  going  in 
there  and  finding  what  you're  looking  for,  otherwise  it's  a  non-sequitur.  *  e  & 

“ ^i^%/osfa  5.;  Sn°vo«”“;S?,ic>l  aB“,cy  ** <0  answer  your  ‘>ues,i‘,'‘  ‘"““s’- wha* 

We  **“ 1SP !°  brin8.us  tbe  tallest  of  the  message  traffic  that  would  contain 

the  target  messages.  We  then  brag  it  to  an  interface,  where,  in  fact,  a  clone  of  that  reduced  set  is  made 
t  he  regular  message  traffic  goes  on,  unimpeded,  to  the  legitimate  recipients  of  it.  We  then  filter  the 
cloned  stream  ot  information  and  the  packets  that  do  not  pass  our  filter,  because  we're  not  allowed  to 
record  them,  m  fact,  vanish  at  that  point.  The  only  tiling  that  passes  our  filter  are  the  packets  with  the 
ofEs  SSmg  5nformat,on  t0  meet  the  order.  And  I  think  we’ve  demonstrated  that  a  number 


In  fact,  we  appreciated  your  visit,  some  months  ago,  when  you  saw  it.  As  to. 


*r* 74 


5/24/02  Release  -  Pi 


;  L£X1S<&-NEXIS® 


h<^:/Aveb,leXjs-ncxis,cotayte.an»M/.(!5=0bc£J0S845!792?6{Sfae72f57 


(CROSSTALK) 


BARR:  When  I  saw  what? 


~  >'ou  were  at  Quamico,  some  of  the  demonstrations  we  ga 


gave  y  ou,  were,  in  fact,  of  these 


to^i^CarSvS!  2g°‘  ™  W*S  °S  CALEA- 11131  wasIike’  four « five  years  ago,  that  had  nothing 


KERR:  Well,. 


(CROSSTALK) 

BARR,  Well,  I  hope  it  didn't,  because  it  wasn't  described  to  me  as  Carnivore, 

KERR;  Hadn't  been  named  yet*  perhaps*  .  . .  . . .  . — . . 

Pf? !j?e  thjoash  an  ISP.  to  fact,  to  do  it 

the  ul,W,=  wSeS’&nXr'1’ “  f“' *"  " 

filtS  **  have  10  pr0vid' ,cctoical  assista"“  by  P“«fa«  our  system  to  the  ISP  in  order  to  do  that 

CANADA: :  The  gentleman’s  additional  time  has  expired, 

yo  “eStaoSj.  And^ “  800d  Prese"“ions  in 

We  will  have- additional  questions,  as  I  indicated  in  the  outset,  and  we  will  do  our  best  ^ 

-eCt&  th8  ^  w*1 S  S  tte^Snllgafe,  we  Ek  yS  foryom^ 

testimony  and  your  assistance  to  the  committee  in  this  oversight  responsibility,  ' 1  ^  r 

And  now  well  move  to  our  second  panel.  And  I  would  ask  that,  as  peonle  are  exiting  th*>  rrtrtm  a«a 

of  th? Stas  SSsecSd* °panefas  fhev  a  y°U  ^  bfcause/ra  8°«g t0  proceedSwith  the  introduction 
iiiemuers  oi  me  second  panel  as  they  are  coming  forward  to  take  their  seats. 

mnceS  fnfLT  thlS  Seco”d  and  fmal  Panel  of  hearing  will  discuss  privacy  concerns  and 
concerns  for  network  security  rai  sed  by  the  use  of  Carni  vore.  y  concerns  ana 
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American  OvjlUbertiesPUn1om1?I  ^  Sleinhardt  Mr-  Steinhardt  is  the  associate  director 


:  of  the 


andrtSIoIoS-!  WC  WlH  hCar  &°m  Mm  Davidson>  wh0  is  the  staff  counsel  for  the  Center  for  Democrat 


Following  Mr.  Davidson,  will  be  Tom  Ferrine  Mr  Perrins  i<c  »  ■ 

Institute  for  Computer  Security.  He  is  alsSe'mSaue^T SiSSf  ^  Te*Stl¥0r/or  the  ^wific 
Computer  Center.  *  We  macager  of  «*unty  technologies  for  the  San  Diego  Sup, 


er 


m  First  Amendment,  telm?an?Smi?c0arions  S  _*2d  H#rtso“»  specializing 


and  communicadonskw  Mr  rw«  I »p«kh3 
three-volume  treatise  entitled,  Modem Conununicati^'J r3f \y '?  f IS  ft0 the  co~  author  of  a 

tltis  subject  previously.  communications  Law.  We  have  heard  fern  Mr.  Com-Revere 


on 


Stewart  Baker,  an  attorney  at  Steptoe  and  Johnson  will  then  testis  Mr  n-t. 

telecommunications  equipment  manufVinr^re  » ,a  *  tcstitj ,  Air.  Baker  represents  major 

Assistance  for  Law  Enforcement  Act  and  law  enfnrrpm  et?  m  connectlcm  with  the  Communications 
gaaen.1  counsel of the ftSSJ a£»“‘ ftS»2tT9eS.r',Umm'“S Bate™s'h' 


Finally,  we  will  hear  Loro  Peter  William  Sachs  Mr  Sachs  owns  tponw  i  vr 
provider  based  in  New  Haven,  Connecticut  IC0NN’  LLC’ 


a  small  Internet  service 


statements  will  be  made',  par,  offe^e® 

So  we  will  now  turn  to  our  first  witness  of  this  panel,  Mr.  Steinhardt. 

STEINHARDT;  Thank  you,  Mr.  Chairman.  .  - 

J.®"  OPPOm,”ity  10  *"*  hOT  M  *1»  »« to  thank  yon  for  so 

bears  a  great  iiofiS  wresOTThty  Utm  e^iSjaSIStow'fo™”'  “”d  “ ,ha' 

hS'top  ofiomS  Canf  nre  is  unprecedented  in  the 

»*'■*  accesses  all  the  comnttntieaSSf  a **  “fo/cem«  Called  a  device 
communications  of  the  target  of  a «SSSiS2? 3  u  /  cu®tomfs>  ra*er  than  only  the 
that  it  sliould  be  granted  access  to  0I?eT\  Never  before  has  a  law  enforcement  agency  claimed 

granted  access  to  all  communications  passing  through  a  service  provides  netJorkbased 


*of?£ 
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W  h^^^-{«is-ncxis.com,'{n.urfi<^.d5=0bcD05a45 1  ?9276f6fa572f57: 

d  °"  m  unsupcrvised  promise  that  it  will  not  stray  beyond  the  confines  of  its  authority. 

t  Carnivore  is  roughly  equivalent  -as  a  number  of  the  members  have  ■  , 

a  wiretap,  capable  of  accessing  the  conversations  of  all  the  phone  company's  cntowS  equivalent  t0 

'  Tf  °*******  **«*  *  suggested  that  the  to  and  toJ^SSSSSS^b!^ 

the  key  to  look  for  which  messages  to  record  the  »n*Wv  „f .  •  *£  Var,mvor®  box  «$e$  as 

post  office  and  stationing  an  FBI  agent  there’  looirin  «  th  !|  e?U!va!ent  of  going  to  a 

goes  through  and  then  picking  out  lose  vdfid  iUvkhes  o  reSdlb!  ™[0TIf'im  Pf  eve2? that 
open  up  and  actually  look  at  le  content.  shes  to  record  either  the  addressing  information  or  to 

Now  I  must  $ay?  I  want  to  comment  oh  one  thing  in  this  section  —  nn^  t  t 

earher  this  morning,  and  that's  this  audit  trail  that  forthe  first time aC^hifindf  Su 

M^Smtly  We  are  t0,d  reCOrds  at  Ieast  what  the  ***  VS2£  ofk~etffif 1 :  ** 

I  think  there  are  probably  a  number  of  things  that  are  worth  noting  about  this  audit  trait  *- 

apparently  was  created  only  recently,  and  I  would  this  . 


use  in  a  yeiy  limited  number  of  cases,  that  °f 

’Wl*0  “  *oto* 

S£fag“^ 

oi  the  order,  not  someone  who's  being  prosecuted?  P*  an  innocent  third  party,  not  the  subject 


llSwnkthll  Sauhe°<«iuMiontta  don‘'  ta''e  f>  opportunity  to  which  to  contest 

carefiliiy  at  all  these  toails  the  audtt  te,I  suggests  ,s  that  you  need  to  look  why,  very 

to  imagine  how  the  operation  of  Carnivore  can  be  scuared  eHhw  «.ritn  tir.tr  .  , 

ECPA,  which  was  adopted  to  implement  the  Fourth  AmendnS fa 

the  intmsion  into  the priracy^f  pSon^wholre  noSgaStoT^e  wTW  ?d  ta,rgetedrso  35 10  awid 
not  have  reasonable  cause  to  belfeve  that  they  are  engafed  in  a  IS  f  Wh°m  8W  enforcement  do« 

,W^SE!°"  °f thts>  E9PA  requires  the  government  to  specific  the  person  who's  the  target  nf  the 
ui\  estigad, Gn>  ensues  under  investigation  the  nattictilar  cvc^m«  ?* 

accessed.  They  place  on  the  provider  of  the aLnuntatiras melSu  S?  he  c?*“toation  15 10  be 
the  communications  of  peons  auihoriaed  .0  be  i«ercepte?fefSfS™«!S°  SePara,e  0“ 

communicatio^ofa'tarEMof a w^B^t^^er'rlP''‘0n  " 'l16 tntercepdon ofnon-iocriramatiog 
Carnivore  is  in  fact  a  “  ‘“n 

en«re  steam  of  communications  <ha,  is  hoveling  '0  ' 
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J«*yAw*Ue^^  : 


Carnivore?  What C^iai"m ECPA^wiSIn  *e s!atuE?ry aatoorizatiOfi  for 

q  Sta  £1  Lfasis(  *“/’""*•  F°vhfcr  Ash'll  OtrSLe?  S' Chat 

ssass  is  ss*= t,  *^«332r# 

never  went  higher  than  one  federal  magistrate.  “  *“  we  talow  V“V llttle  about  and  that 

%,t 

JiSKK^Js^ 

m  a  bald  criSaTyS'ion'Sh^I  wS^S'need 5  took ^fth?Suao“i?of  th ^m“lh,?  bflF 
mat  -  the  recent  history  tells  us  that  the  FRr  r^r *  j ,  i  l  .  or>  &}  toe  FBI,  which  tells  us 

data  ,h„  Carnivore  is  a  permissible  &  -  id'  KSSSfiEtf^  “ 

Let  me  give  you  --  let  me  give  you  some  examples. 

£tssif&r  »s±EaS±&  ^s^ss^sr^ 

enforcement,  lawenfoS£X!^  fa 

provtte  ,o  provide  it  with  new  sorvciltante  cpahililKS^S eJ^StoS 

,ly  ““.eS  greater  capacity  and  new  surveillance  fealuies  Sfan  Ito  M  l  t  oJfS’ *!  ™h?.s 


fcLTSKmenf  a”*le  ^  0,b"S  mbm*  ’**»*»■  B«  I  »>  Wc  »  exampie  is  worth 
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tej?“*Ti  i,h  refcra>«'»  this 

be  called  tracking  information."  p  orroats°n  “  t0  mquine  anything  that  could  properly 

Well,  whether  or  not  that  was  Director  Freeh's  infom;^  i  on/  v  .  , ,  , 

1995.  And  the  FBI  has  fought  tooth  and  nail  L fe?S  di!?  »  \  qtf^  became  the  FBI’s  policy  in 
before  M  Federal  Communications  Commission  and  now  in  th^T 6r ph°0e L®dustry.  then  with  - 
Colombia,  fought  tooth  and  nail  for  the  proposition  that  CAFEA  Ha  ??*  of  Appea5f  for  District  of 

operators  to  provide  It  with  location  tracking inSSaariom^  f  *’  d°eS  re<*mre  the  cellular 

hear  >'ou’re  going  £o 


targeted  set  of 


suggestions  of  the  witnesses  that  you  -  that  you  heard  earlier  wP  y<Ju  no!to  SJmPIy  trust  on  faith  the 
somce  providers  cannot  provide  £n  iSSfotaSiL  *’  *“  ***“  haVe  bee»  «**  that  other 

know  tfiX senSe^mvldS^o^l^  Sis  fofo^atTon  wK  ^  ^°ri£S>"  0r  in  this  case>  "We 
tS  w  klWW  about  in  detaj/and  n«SS*2hhiS!!?,1^to  S  black  box"  7112 

seal,  because  these  eases  all  come  up  ex  parte  -  these  r®^^st  fi^orders^w^up^ex  p^^l^E^hlinlc 

not  prepared  to  ask  you  to  doSSh  mS^thanSusTthemaS  2^*°*“**  &°m  the  80vemment  were 

explain  to  all  SieSmbm  of  cat1  ^clude,  because  -  let  me  just 

the  importance  of  this  in  any  way,  but  we^o  have  aSS  nf/n  ^  ^T*5^  That*s  not  minimizing 
which  we  are  moving  to  after  this.  h  g  0n  a  proposaI  tha{  Mr.  Frank  has  introduced 


the  panertent  **  y°U  Can  rea3I>'  **  clo$e  to  «*  «™  minutes,  it  would  be  beneficial,  giv, 


gi  ven  the  size  of 


FRANK:  Mr.  Chairman? 


CANADY:  Yes? 


FRANK:  Is  it  the  intention  of  the  chair  to  adjourn  this  hearing  and  go 


to  the  next  one  at  4? 
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ft^te  Itenrt  hcrt&”  °f  th'  Cll*ir  ‘°  h“r  the  Witaesses  “d  10  have  °"e  rou"d  of  questions,  and 

FRANK:  Thank  you. 

STEINHARDT:  Well,  HI  stop  there,  and  allow  the  rest  of  the  panel  to  speak,  then. 

CANADY:  Thartk  you*  Mr*  SteinhardL 
/ 

Mr.  Davidson? 

P.av^s0P’ Center  for  Democracy  and  Technology.  Fd  like  to  thank 
the  Fourth  e’*tea‘”  °f 

ssss»is=^^5^rs^^  --^‘Ssssrir- 


7p*47?r 


S  l-e  *****  <iueslioas  about  Carnivore.  I  think  the  threshold  question  for  Carnivore  is 

,  ,  Caron  ore  has  access  to  much  more  iniormation  than  it  is  legally  entitled  to  collert  Hnu,  rin 

wo  taw  tta, «  Ott  trust  Carnivore?  How  do  we  taw  wtat  kind  of  S Is  b£f p«  on SB 

SkS  IhZitSf  co“ee‘s  indulgence,  try-  to  give  the  committee  a  sense  of  a  little  bit  of  what  we’re 
talking  about  with  packets,  here.  I’ve  got  a  couple  of  slides  that  I'd  like  to  put  up  quickly. 

rfSnyt,iwfw  3  couPje,of  disclaimers.  These  are  captures  of  actual  real  packets.  And  for  those  who 
do  I  bring  their  opera  glasses,  these  are  actually  —  should  be  in  your  nacket^  TKpvV*  an  ■?  r  r  n 
m  the  audience  ~  they’re  the  last  three  pages  of  my  testimony,  '  P  'Y  re  the  “  and  for  {o]ks 

SaS  S2iSff?l  PlcketS  tbat  have  bf«  captured  from  CDTs  network  with  a  very  crude  tool  : 
S  7  loofc  idee  what  Carnivore  looks  like,  but  I  thought  ifd  be  hefcfuHbr 

hardS2do  som!  Sllhln  S  f  *hat.$ome  things  that  we’re  talking  about  look  like* and  how 
Carnivore.  °Pd  ^  1,8  {hat  Carnivore  says  it  s  doing,  and  how  hard  it  Is,  maybe,  to  trust 


raessa?eSSS:r1^m  t  Ttht th‘S  ^  padcet  is  a  sampj8  e'  mat‘}  message  ~  actually  a  real  e-mail 
~  of  If  om  iSrk  }  ’ SubC0mmmee  counsel> 0R  Frfday  and  was  captured  otTofour  web 


site 


S?thateS5 hlr  f  h Is  ^hai  a?icket  sniffer  do®s  to  a P^ket.  It,  kind  of,  breaks  It  up  into  different 
pieces  that  can  be  understood.  And  there  are,  sort  of,  really  —  sort  of  two  chunks  to  thic  mforrr„fi«T, 

^  t0/AWhiChr  i0t  pfpeopl?cali  header  information,  which  contains  a  2#  of 
me  aaaressmg  information  and  description  of  the  packet.  The  second  half  of  h  is  wh-u  T  oati  o,* 

or  payload  of  the  pacta.  And  WLludc,  thfdan,,  the ,e  xt£ “£uf‘ ¥±, 'tiSStiSZ*- 
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topics,  or  political  topics,  or  social  topics,  and  all  of  this  gets  listed  fa  this  pen 


register  for  the  Internet. 


— ~  sumc  oi  inese  t times,  these  ml***  that  «r»w  A  r.T\\;  * M  10  lfv  to 

came  up  with  m  the  old  context,  the  telephone  contTt  fot  examnle  12  ffe  re§^  we 
something  -  was  something  that  wasn’t  as  sensitive^ SS!'  r  that  dlg,ts  diaied  were 

extremely  low  standard  for  access.  * d  e’ 1  thmk>  Congress  to  create  this 


$s$& 


probable  cause  standard  in  &e  pen-renter  coSS  rcaSonable  “ 1  meari  a  Levant  standard  and  a 

about  how  it’s  being  sSoSeto^  w^onwmSaT't  fe*f  Coricems 

be  opened  up  for  the  world  to  see.  There  needs  to  he  vlt If  fd  ab,out  the  that  it  needs  to 

know  exactly  which  pieces  of  the  packet  Carnivore  is  locking  "* 

people  wh^OT  posWoSo  tlS balmctog  S'”1  “ thC  hal,*  of  ,h' Isp-  The  ISPs  are  the 

»  ' 

And,  finally,  1  think  all  of  this  points  to  the  need  fbr  rsnmvw  +  *  - 

i=ebeT™“ 

The  White  House  has  taken  a  good  first  step  We’re  looking  fnnisor-t  «  , . 

step  doesn't  quite  go  far  enough,  but  we  really  want  to  wolf  wS  PdS  ,wf  fcmS  w<*  everybody.  That 

protections  here.  0  '  mi  10  vv  orK  w,th  folks  to  try  and  improve  the  privacy 

Thank  you  very  much  for  your  indulgence. 

CANADY:  Thank  you,  Mr.  Davidson. 

Mr.  Perrine? 


subject  of  Carnivore  and  the^SSjendmem^ l°Seveth£fee  5'0U  for  me  to  testify  on  the 

trSslISfnnr  °'!  C0tmrtl0nJ>' as  Carnivore  is  really  about  thSsSemnS^  F®rs,new 
translate  the  polices,  law  and  pmcttces  of  telephone  wtetaps  a,V dfgSl  ralm“ y 

Today  s  testimony  has  shown  over  and  over  again  that  there  are  that  ,5,„ 
old  law,  as  applied  to  the  Internet,  may  be  leading  to problems  “  **"“  d,ffia 


'ring  interpretations  of 
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privacy  of  citizens  may  be  eroded  in  ways  not  intended  or  permitted  under  current  wiretap  laws. 

to  Snf2^?SfiSeCyrity* fVe  aIwayS  ^een  an  advocate  of  personal  privacy,  unrestricted  access 
Dm  toll Sa?the  IS °V#^ intervention  in  the  lives ofdaSdtoglSs 
to  kteStafR?  w!  ?KC  P«  f,  Cenie.r>  1  a!so  onderstand  the  need  of  law  enforcement  to  be  able 
to  intercept  traffic.  We  spend  an  awful  lot  of  ttme  detecting,  analyzing  and  tracing computeitmsions 

ran  tai  S2S 2Sl“dS  of  l,w  privacy  are  not  mutually  exclusive.  There 

SpSk°o?rea5ime  infra/truucture  ~  and  someone  did  use  the  word  Echelon  ~ 

vapaotc  oi  real -time  monitoring  of  large  numbers  of  phone  calls.  It  does  aonear  on  its  tn 

specifically  designed  to  meel  the  rigid  requirements  of  a  Title  HI  wiretap  order  or  pen-register  order.°° 
communications  of  the  innocent  with  those  of  suspects  This  is  an  interLin*  ll  1UK. 


mm 


*u  *  ’  r -  v  miudiacmai  ievei  miercepi  and  c 

that  m  order  to  select  or  reject  data  based  on  its  filtering  rules. 


data  with  its  filter  and  rf* w*©  ib*  a  **  occur  it  a  program  compares  the  intercepted 

by  a  hu™  b“eg  Sft  KSSS^*^SSST^  “ ,mly "" ,he  «"*  « 


ralS^L'0^/5  ■JU?,a  tooi  811(1  its  capabilities  must  be  considered  in  the  context  of  how-  ii  CnnM  ho  „c^ 
Carnivore,  with  no  filter  annear®  *«  h« 3-  ,  .  .UiUCAl  01  no*  u  co^m  be  used. 


using  Carnivore 


it’s  installed  or  the  true  caoabilities  afc7rnZrZZZ  7  -■ m  a^aroivore  ****»»  at  the  time  (hat 

installation  and  the  filters  during  the  nSnitoring  process.  K“mim"8  the  sou'“  00dl!  of  fte  sys,«”  <*“>>»* 


SumSeto^lST  Ca,“  f°r  pl,b!i“io"  °f  ,he  «*  oft the  Carnivore  system  and  their 
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vemication  validation  organization,  would  provide  only  a  snapshot  of  Carnivore's  capabilities  with  n. 
?SwT  CarBiV°re  pr0gram  actuaI1y  **■»*  «  » ISP  was  built  from  t£ 


no 


uac*er  instant  development,  so  the  source  code  snapshot  that  was  reviewed  would  be 

\anoauoq  process,  you  II  never  know  that  what  was  installed  was  actually  what  was  reviewed  And  there 
a^vencase  ***** review  that  wouId  indicate  the  fibers  that  were  installed  in  Carnivore  at  a  given  ISP  on 


a  *T - nuwu  «^hcu  tu  uic  wwnrci,  ana  i  mmK  we've  seen  that  todav 

And  applying  these  old  laws,  may  unintentionally  erode  constitutional  protections  in  unintended  ways 


Law  enforcement  may  need  appropriate  legal  access  to  internet  communications  under  limited 
SSSig8  ”us,  be  profKdy conttoik<1  “<*  to  ensure  that  constitutioMl 


Thank  you. 


CANADY:  Thank  vou. 


Mr.  Com-Revete? 

Sto^CJS“0^cCana<iy  “d  ”embm  °f  ,be  “totnittee,  thank  you  for  inviting  me  back  to 

uC  to^dSSaSmrnf  T  ^ m  6ve  minutes  or  so.  111  dispense  tvith  that  and  just 

^  ofthfpomts  about  Carnivore  that  were  discussed  in  the  testimony  of  the  government 

ses.  HI  just  fry  and  touch  on  two  or  three  points  related  to  what,  in  my  experience,  was  Carnivore 


witnesses, 
in  its  natural  habitat 


One  of  the  first  points  that  was  made  is  that  Carnivore  is  used  in  only  very  limited  wavs*  that  it's  used 
only  when  an  Internet  service  provider  either  cannot  or  will  not  comply  with a S!t  «35r. 

Pamter  tes^fie^ that  &  &e  one  challenge  that  he's  aware  of,  that  incoming  e-mail  addresses 

tlie  instalkloifl/^1^  *  T*1*  rec^ve^>^a{  then  required  tlie  government  to  move  forward  with 

the  installation  of  Carnivore.  That  s  not  quite  what  happened  in  that  case. 

i  Whtch  I  was  involved,  the  ISP  did  try  to  comply  with  a  lawful  court  order,  the  pen-register 
FWtmn^  r'traCe  °rder- 11  ls?mply  taken  as  a  §iverl»  the  ISPs  are  obligated,  under  the  term/of  th? 

Pnvacy  Act,  to  comply  with  lawful  orders  of  the  -  lawful  court  orders  to 
P  e  in  conation,  but  at  the  same  time,  they're  required  to  protect  the  privacy  of  their  subscribers 
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£n  thiscase,  the  solution  that  the  ISP  put  in  place  did  get  all  of  the  outgoing  —  excuse  me  —  all  of  the 
incoming  e-mail  addresses,  and  it  did  supply  a  smaller  number  of  outgoing  e-mail  addresses  to  the 
government.  They  were  dissatisfied  with  that,  saying  there  must  have  been  more  outgoing  e-mail 
addresses,  “  ° 


fa  fact,  we  tned  to  explain,  that  they're  any  number  of  reasons  why  there  may  be  fewer  outgoing  e-mails 
then  there  were  incoming  e-  mails.  For  example,  the  target  of  the  investigation  might  have  used  a 
web-based  e-mail  source,  rather  than  using  his  own  resident  program.  But  nonetheless,  the  U.S.  marshals 
were  dissatisfied  with  that  solution  and  informed  the  ISP  that  they  were  coming  to  install  Carnivore 
wnthrn  two  days.  That's  what  prompted  the  court  action  that  led  to  the  magistrate's  order. 


I  believe,  Mr.  Painter  then  testified  that,  since  that  time  the  ISP  has  provided  excellent  cooperation. 


In  fact,  the  ISP  has  done  in  subsequent  cases  what  it  did  in  that  case.  It  provided  and  offered  to  provide 
ways  to  comply  with  orders  that  it  received  in  ways  short  of  installing  Carni  vore,  and  since  that  time 
Carnivore  has  not  been  reinstalled  on  its  system. 


Secondly,  in  response  to  a  question  from  the  chairman,  one  of  the  government  witnesses  suggested  that  it 
was  the  ISP  and  its  implementation  and  not  the  Carnivore  program  itself  that  caused  a  erashand 
disrupted  the  ISP’s  system. 


In  fact,  our  experience  was  that  Carnivore  was  incompatible  with  this  system,  requiring  the  ISP  to  make 
adjustments  w'hich  led  to  a  number  of  problems,  that  ultimately  led  to  Carnivore  being  taken  out  and 
then  the  next  day  the  order  for  its  installation  expiring. 


me  say  just  one  other  thing  about  that  order.  In  fact,  there  was  a  magistrate’s  order,  still  under  seal 
did  require  the  installation  of  Carnivore 


CORK-REVERB:  We  tried  to  work  out  in  the  terms  of  that  order  what  safeguards  we  could  to  make  sure 
that  no  more  information  could  be  collected  than  necessary’.  But,  in  fact,  what  the  magistrate  said  in  that 
order  was  that  he  would  welcome  the  decision  on  the  legality  of  Carnivore  under  the” existing  legal 
scheme  to  be  decided  by  a  reviewing  court.  We  haven't  had  that  kind  of  legal  review  yet,  andl  don't  know 
of  a  case  m  which  that  may  occur.  ? 


Next,  the  government  witness  talked  about  the  number  of  safeguards  that  exist  to  make  sure  that 
Carnivore  does  not  lead  to  excessive  violations  of  subscriber  privacy.  For  example,  Dr.  Kerr  testified 
that  the  filter  will  ensure  that  Carnivore  acquires  only  the  information  that  is  authorized  by  a  court  order 
and  suggested  that  It  would  be  necessary  to  obtain  the  assistance  of  a  technician  or  even  perhaps  the 

fnS,lSl0f&ei IS?  t0  Programming  of  Carnivore  so  that  a  rogue  agent  might  gain  information 

to  which  he  or  she  is  not  entitled. 


Pm  not  a  technician,  so  I  can't  really  address  that  point,  but  I  can  say  that  in  the  case  that  I  was  involved 

ITU  1  fftl/l  ilfAf  /^A**wJ* J  L  ^  -  _ _ _ _  J  t  y 


.  ufcurauwi  vnrmvcre  couia  t>e  Changed  with  the  flip  of  a  switch.  Maybe  that's  correct,  maybe  it’s 
incorrect,  1  don  t  know.  It  does  suggest,  perhaps,  that  the  proposals  that  have  been  discussed  earlier  for 
independent  review  of  Carnivore  really  are  in  order. 
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Ve  !ulf!t&tri?  Wtl1  be  pnfected  from  invasions  of  privacy  because  there  is  an  audit  trail  that 
makes  sure  that  the  filter  is  correctly  set  to  correspond  to  what  is  authorized  by  the  court  order  and  that 
that  will  be  available  with  the  evidence  m  a  prosecution.  But  in  fact  that’s  a  safeguard  that  exists  only  if 

Thete  is  no  requirement  to  notify  the  target  of  a  surveillance  in  a  trap-and-trace  situation  that  that 
surveillance  took  place.  So  if  —  there's  no  way  to  ensure  accountability  in  that  circumstances^ 


w c  !f  !S  Tr B  h  k  d  WhCther  or  m  Carn,vore  has  bee»  used  for  violations  of  any  other 
laws,  such  as  antitrust  laws  or  consumer  protection  laws  or  anything  else.  The  response  was  given  that 

Carnivore  can  only  be  used  m  the  event  that  there  are  specified  federal  felonies  as  set  out  in  Title  Hi. 

As  a  matter  of  fact,  that’s  tnie  only  tor  Title  HI  intercept  orders.  You’re  not  required  -  or  you're  not 
limited  in  the  use  ot  Carnivore,  in  the  event  that  it's  being  implemented  in  response  to  a  trap-and-trace 
or  er,  to  the  feJomes  that  are  specified  in  Title  1IL  ,411  that  has  to  be  shown  is  a  certification  that  the 
prosecutor  or  the  law  enforcement  agent  involved  believes  that  the  use  of  Carnivore  would  be  relevant 
and  the  information  gained  would  be  relevant  to  an  ongoing  criminal  investigation. 

if  rhfrmh‘aV?!°  Sayis  just  paraphrasing  what  I’ve  written  down  and  that's  already 
submitted.  And  1 11  just  leave  it  at  that  and  be  happy  to  answer  your  questions  later. 

CANADY:  Thank  you,  Mr.  Com-Revere. 

Mr.  Blaze? 


BLAZE:  Thank  you,  Mr.  Chairman. 


I'm 


?  1 !!lP<>im  °tUt  that  “V  co?1fents  here  don,t  necessarily  represent  the  viewpoint  of  my  employer 

here,  so  to  speak,  on  my  lunch  hour  to  provide  the  scientific  and  technical  perspective.  F  y 

My  interest  in  the  problem  of  intercepting  traffic  on  the  Internet  for  anal  ysis  dates  back  to  my  doctoral 

discovSdthenULnd  33*  that  { would  analyze  as  part  of  my  dissertation  vvork.  mat  I 

discovered  then,  and  what  s  certainly  become  even  more  the  case  as  we've  gone  to  higher  speed  and  more 

dSPinmkTntdS  0f,netT?Srth  ^0re  Pf to.cols  nirmm  on  top  of  them,  is  that  die  problem  of  collecting 
data  from  Internet  packets,  from  the  packet  level,  is  a  very  subtle  and  difficult  one, 

BLAZE.  So  my  comments  today  address  the  question  not  of  how  do  we  ensure  against  the  oossibilitv  of 
malice  or  misdeeds  on  the  part  of  law  enforcement,  but  starting  from  the  premise  that  everybody  is  acting 
with  good  will  and  honest  -  and  perfectly  honestly,  even  still  it's  difficult  to  be  sum  th ?Se  hSls  be2g  g 
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used  to  collect  information  from  packets,  in  the  way  Carnivore  does,  are  behaving  faithfully  and  reliably. 

In  particular,  there  is  a  strong  possibility  that  omissions  of  collected  data  or  garbling  of  collected  data 
could  cause  misleading  results  that  could  put  information  collected  out  of  context,  or  collect  data 
inadvertently  that  should  be  attributed  to  another  source  or  destination  than  it  may  initially  appear. 

!f,?°  2sIematif  Wfy*  Un^rtunately  ~  we  in  the  computer  security  community  learned  this  over  and 
over  again,  these^are  hard-  won  lessons  ~  them  s  no  systematic  way  to  deal  with  large  complex  systems  of 

semSy^?^11^  l'Wte  **  &nctI0n  ofthe  software  h  security-critical.  Certainly,  Carnivore  is  a 


that  very'  often  they  fail  silently, 
working  properly,  but,  in  fact,  subtle  bugs 


mean  that  there  are  vulnerabilities  or  mistakes  there  anyway. 


So  we  have  the  problem  of  being  concerned  with  the  reliability  of  data  collected  by  a  complex  piece  of 

rCSvl  the  problem  of  ensuring  that  something  connected  deep  within  the  infrastructure  of 

S^^Shv^^>frOV,do  *  5tSelf  vtulneraSe  10  extemal  tapering  or  could  itself  be  -  have  control 
taken  over  by  a  malicious  third  party  who  is  able  to  get  access  to  it  by  exploiting  some  bug. 

There're  two  ways  that  we  stumble  along  in  trying  to  assure  ourselves  that  complex  systems  that  we  want 

is,by  f?“sed  revicw  by  by  **«».  and  1 0.3  S" 

strongly  adv  ocate  that  the  kind  of  focused  review  by  independent  experts  that  was  discussed  in  the  first 
panel  be  done.  But  there  are  limits  to  what  a  limited  set  of  experts  can  ever  discover.  We  discover  again 
and  again  that  even  after  a  security  audit,  new  information  comes  out  about  the  environment  in  which  the 
software  may  be  used  or  something  may  have  been  missed  by  the  pane!  of  experts  that  could  only  be 
known  by  widespread  publication  ofthe  source  code  and  details  ofthe  architecture  ofthe  system. 

The  security  community,  pretty  much  unanimously,  supports  the  idea  that  source  code  should  be 
published  for  any  system  that  performs  a  vital  security  critical  function.  And  I  think  the  Carnivore 
system  i  s  a  very  good  ex  ample  of  this* 

objections  raised  to  doing  this  in  the  case  of  Carnivore  is  that  it  might  provide  aid  and 
comfort  to  the  targets  of  investigations,  who  might  find  ways  to  circumvent  the  system,  f  think  in  the 

7i?~  ex!stence  md  *?  architectural  details  ofthe  Carnivore 


microphone  lhafs  been  installed  in  your  apartment. 


S  SSteSwll  p1Siac„Cl“,,Uld  be  tatereS“d  “  "  d*i,S  »f’ — or  not 


Cat^vorelnstaUations’  ^  ^  advocates  PybHshinS the  details  -  the  operational  details  of  specific 

r?COmn;end  that  T  " that  nehher  ~ that  while  neither  focused  review  by  independent 
experts  nor  publication  of  source  code  are  panaceas  and  ensure  against  any  possible  problem  or  abuse. 
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these  are  essentia!  steps  **  widely  recognized  essential  steps  that  certainly  should  be  done  in  this  case 
And  I  hope  that  will  happen. 


Thank  you. 


CANADY:  Thank  you,  Mr.  Blaze. 


Mr.  Baker? 


BAKER:  I've  been  on  both  sides  of  some  of  these  debates.  And  I  have  to  say  I  see  both  sides  of  this  one.  I 
think  in  some  ways,  both  sides  of  this  debate  are  stuck  in  a  -  in  the  telephone  world.  A  lot  of  the 
witnesses,  some  of  the  questions,  suggest  that  maybe  we  could  solve  this  problem  by  having  ISPs  take 
responsibility  for  doing  these  intercepts  themselves. 


And  actually  I  think  the  FBI  has  got  this  about  right.  If  the  ISP  wants  to  do  it,  then  they  should  do  it.  But 
a  you  tnko  an  ISP  —  a  small  ISP,  and  tell  them,  "You  have  to  do  it/'  they're  going  to  treat  this  like  an 
expensive  unfunded  mandate.  And  there's  no  reason  why  they’re  going  to  do  it  more  enthusiastically  or 
more  privacy-  protectively  than  the  FBI.  In  fact,  there’s  going  to  be  less  oversight. 


Dus  is  not  the  phone  company  that  could  just  hire  somebody  to  do  the  wiretaps  every  day  and  add  it  to 
the  rate  base.  They're  not  going  to  be  doing  what  people  saw  the  phone  companies  do  by  way  of 
protection  if  they’re  small  ISPs  and  they  don’t  want  to  have  this  role.  And  I’ll  tell  you  there's  plenty  of 
ISPs  that  really  don't  want  this  role  in  spite  of  the  noisier  ones  who  do. 


But  I  think  the  FBI  and  the  Justice  Department  are  also  living  in  the  past.  To  say  you  don't  have  an 
expectation  of  privacy  in  information  that  is  in  the  hands  of  a  third  party  in  the  internet  age  is  just  crazy  1 

mean,  our  entire  lives  are  in  the  hands  of  third  parties. 


To  treat  the  to  and  from  lines  in  e-mails  as  though  they  were  just  the  same  as  the  phone  numbers  that  you 
aial  is  also  bizarre,  w  e  know  that  the  phone  company  collects  those  phone  numbers  because  they'  send  us 
a  bill  with  those  phone  numbers  evety  month.  No  one  expects  the  ISP  to  be  collecting  our  to  and  from 
lines,  especially  not  the  from  line.  They  don’t  use  the  from  line  to  deliver  the  message,  you  know.  That’s 
just  content,  and  they  should  get  a  Title  HI  order  to  collect  it. 


So  if  relying  on  the  ISP  doesn't  work;  if  this  really  is  a  privacy  problem,  what  should  we  be  doing? 


1  guess  I  w'ould  say  a  couple  of  things.  First,  as  Mr,  Nadler  suggested,  w'e  ought  to  be  sending  notice  to 
people  when  they  ve  been  subjected  to  this  kind  of  intrusion.  We  have  a  system  right  now  that  protects 
the  privacy  of  the  crooks,  but  not  the  innocent  people  who  are  investigated. 


You  know,  if  Mr.  Davidson  were  under  investigation  -  he  sent  that  e-mail  to  Mr,  Tavlor,  The  next  step 
that  the  police  would  take  would  be  to  put  a  cover  on  all  of  Mr.  Taylor's  e-mails  in  and  out  It's  perfectly 
relevant  to  their  investigation.  They  want  to  know  whether  he’s  also  corresponding  with  other  crooks  that 
they  re  investigating.  So  they’re  going  to  have  60  days  or  120  days  of  Mr.  Taylor’s  in  and  out  e-mail,  just 
automatically.  And  he'll  never  know  it,  because  he’s  not  going  to  get  indicted  and  get  to  see  that 
mtormatioiL 
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There  ought  to  be  notice.  Only  you  guys  can  make  that  happen. 


There  ought  to  be  oversight.  The  audit  provisions,  again,  are  very  protective  of  crooks,  but  not  of 
innocent  people.  Tire  criminal  defense  attorneys  are  going  to  get  to  see  this  and  they’re  going  to  be  able  to 
follow  that  audit  trail,  but  Mr.  Taylor,  if  his  e-mail  has  been  intercepted,  isn't  going  to  get  a  chance  to  see 
that  audit.  There  needs  to  be  somebody  who  will  do  that  audit  on  behalf  of  ordinary  citizens;  we  shouldn't 
be  relying  on  criminal  defense  attomies  to  do  that  for  us. 


Last  point,  if  you  want  to  do  something  about  this,  you  probably  ought  to  do  it  pretty  quickly  .  That’s 
because  Carnivore’s  not  the  only  way  in  which  this  is  going  to  happen.  Tire  Communication  Assistance 
of  Law  Enforcement  Act  had  a  provision  that  said,  well,  everybody  has  to  provide  trap-and 
trace-capability.  The  FBI  has  said  that  means  packet  data  carried  by  carriers  has  to  have  a  trap-and-  trace 
capability.  The  FCC  has  said,  We're  telling  everybody,  you've  got  to  have  something  installed  -  all  you 
earners  have  to  have  the  capability  of  doing  this  trap-and-trace  by  September  of 2001 . 


BAKER:  We  aren’t  going  to  tell  you  how  to  do  it,  but  we're  going  to  tell  you  you  have  to  have  it  done  by 


There’s  only  one  -  well,  there’s  two  ways  to  do  it:  either  let  the  FBI  install  Carnivore  or  you  go  out  buy 
Carntvore  on  your  own.  I’m  not  sure  those  are  really  the  only  solutions  that  we  want  to  have  carriers 
have,  but  unless  the  FCC  backs  off  of  its  deadline  and  its  current  mandate,  that's  what's  going  to  happen 
and  it’ll  be  too  late  to  install  a  lot  of  controls.  ri 


Thank  you. 


CANADY :  Thank  you,  Mr.  Baker. 


And  last,  but  not  least,  Mr.  Sachs,  and  I  apologize  for  not  having  more  table  for  you  there. 


SACHS:  That’s  OK.  I’m  going  to  be  very  brief  in  the  interest  of  time. 


My  name  Is  Peter  Sachs,  and  I  m  the  president  of  ICONN.  We’re  a  small  Internet  service  "provider  based  in 
New  Haven,  Connecticut.  And  I  believe  I’m  one  of  the  small  ISP  that  Mr.  Baker  may  be  referring  to. 


We  do  have  the  capability  -  in  fact,  any  ISP  has  the  capability  of  supplying  the  FBI  with  exactly  what  it 
wants  in  a  more  accurate,  more  efficient  and  more  private  manner,  because  we  have  absolutely  no  need  to 
look  at  anybody's  information,  except  for  the  actual  target. 


FRANK:  Mr.  Chairman,  could  the  witness  speak  up  a  little  more,  please? 


SACHS:  Any  ISP  can  do  this,  in  as  little  as  two  lines  of  programming  code.  It  doesn’t  require  any 
machine.  It  doesn't  require  any  specialized  programming  skills*  beyond  the  programming  skills  of  a 
normal  system  engineer  at  an  Internet  service  provider. 
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To  confirm  this  statement  ,  I  asked  my  system  engineer  to  set  up  a  system  to  monitor  ail  of  my 
communications.  And  in  less  than  hour  he  was  able  to  see  everything  that  was  sent  to  me  or  from  me  on 
his  machine  in  clear  legible  text.  So  there's  no  need  for  any  specialized  machine  or  any,  sort  of, 
specialized  knowledge  to  be  able  to  do  this. 


Carnivore  also  creates  an  extreme  security  risk  for  an  ISP.  To  allow  a  third  party  to  attach  a  computer 
especially  a  secretive  computer  that's  accessible  from  a  remote  location,  to  an  Internet  service  provider  is 
unheard  of.  It  just  provides  any  hacker  out  there  with  yet  one  other  doorway  into  which  they  can  enter 
your  network,  and  essentially  destroy  your  network  along  with  all  of  the  data  of  all  of  your  customers. 


Carnivore  also  presents  a  performance  hit  for  an  ISP.  The  moment  you  intercept  all  information  flowing 
over  an  ISP  s  network,  which  is  what  Carnivore  does,  it  causes  a  bottleneck.  Bottlenecks  cause 
slowdowns.  As  all  of  you  know',  the  Internet  is  already  slow  as  it  is;  slowing  it  down  even  further,  doesn't 
help  matters  much. 


Lastly,  it  may  have  a  chilling  effect  on  the  information  that  ray  subscribers  or  any  ISP  subscriber  sends 
over  the  Internet.  If  you're  not  going  to  send  something  because  your  afraid  of  its  content  or  perhaps  rust 
its  destination,  it  raises  very  valid  First  Amendment  concerns. 


If  tlie  ISP  gathers  the  data  for  the  FBI  under  a  court  order,  the  FBI  can’t  possibly  see  anything  it's  not 
supposed  to  see,  because  they're  only  getting  what  we  give  to  them.  If  the  FBI  does  the  work,  thev  at  least 
have  the  ability  to  see  anything  they  want,  and  they  do,  in  fact,  have  the  ability  to  see  anything  they  want 

fhe  former  method  protects  privacy  and  the  latter  method  invites  abuse. 


Since  the  ISP  can  provide  the  ISP  with  exactly  what  it  wants,  without  imposing  upon  the  privacy  rights  of 
all  the  subscribers,  why  Carnivore?  Why  use  the  most  intrusive  means  if  the  least  intrusive  means  are 
readily  available? 


Thank  you. 


CANADY:  Well,  1  want  to  thank  all  the  members  of  this  panel  for  your  very’  helpful  testimony. 


I  just  have  one  question,  related  to  Mr,  Sachs’  testimony'.  Mr.  Sachs  has  testified  that  doing  the 
interceptions  or  executing  a  trap*  and-trace  or  pen-register  order  is  a  simple  matter  for  any  ISP;  can  be 
done  m  an  hour  just  a  little  programming  and  there  it  is.  Now,  that’s  not  consistent  with  what  the  FBI  has 
told  us  their  understanding  is. 


And  let  me  ask  -- 1  guess  maybe  Mr.  Blaze  and  Mr.  Perrine  would  be  two  who  might  be  in  the  best 
positron  to  give  me  your  take  on  whether  it’s  closer  to  what  Mr.  Sachs  says  or  exactly  as  Mr.  Sachs  says 
or  what  the  FBI  has  had  to  say  on  that.  .  J 


L  it  as  simple  as  and  I  m  not  trying  to  be  -  single  out  Mr.  Sachs  here,  but  that's  a  fundamental  question 
ror  us  to  look  at.  Is  it  as  simple  from  ~  in  your  understanding  as  Mr.  Sachs  has  presented  it,  or  does  he 
have  a  programmer  that  has  special  expertise  that  other  ISPs  might  not  have7 


PERRINE:  Well,  I  can  address  that  from  the  standpoint  of  tracing  computer  intrusions  and  attempted 
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intrusions,  I  would  say  probably  30  to  50  percent  of  the  ISPs  that  we  contact  don’t  keep  much  in  the  wav 
of  logs.  We  tend  to  deal  with  a  lot  of  the  smaller  ISPs,  we  tend  to  see  the  same  ISPs  ~  the  problematic 
ISPs  over  and  over  again. 


I  think  that  it  s  fair  to  say  that  many  ISPs  could  solve  this  problem  if  they  were  motivated  to,  but  it’s  not  a 
profit  center.  They  aren’t  making  money  cleaning  up  or  preventing  computer  intrusions  at  other  facilities 
and  they  certainly  aren’t  going  to  make  any  money  providing  information  to  the  government. 


PERRINE:  They're  not  financially  motivated  to  do  it.  Some  of  them  have  the  technical  capabilities  and  I 
would  have  to  say  that  there  are  some  of  them  that  do  not. 


CANADY:  Mr.  Blaze? 


BLAZE:  Sir,  I'd  just  like  to  -  from  a  technical  perspective,  the  answer  is  like  most  subtle  technical 
questions.  It  depends. 


Die  problem  with  a  system  like  Carnivore,  from  the  point  of  view  of  complexity,  is  that  it  has  to  be 
general  purpose;  it  has  to  work  under  a  wide  variety  of  operational  conditions;  and  it  has  to  work  to 
collect  a  wide  range  of  kinds  of  information,  depending  on  what  the  court  order  is  asking  for. 


Some  ISPs  may  already  have  in  their  network,  for  example,  logs  of  information.  They  may  have  for 
example,  port  replication  capabilities  on  switches  that  allow'  them,  much  more  conveniently  than  an 
external  tool,  to  collect  the  kind  of  data  that  Carnivore  or  a  Carnivore-like  system  could  only  collect 
with  some  trouble  and  with  some  difficulty  assuring  yourself  that  it’s  operating  correctly. 


In  other  cases,  there  may  not  be  the  exact  capability  required,  so,  it  depends. 


PERRTNE;  Ifl  could  just  add  —  if  the  equivalent  of  Carnivore  were  available  in  open  source,  that  would 
make  the  ~  that  would  lower  the  barriers  to  entry  for  the  smaller  and  less  technically  capable  ISPs  to 
provide  this  information. 


And  I  think  that  this  is  something  that  is  quite  feasible.  It's  not  a  six-day  project,  it's  not  a  six-year  project 
it  s  probably  on  the  order  of  I  think  maybe  three  to  nine  months  at  the  outside  for  the  open  source 
community  to  reproduce  large  parts  of  the  Carnivore  system.  And  that  would  make  it  easier  for  smaller 
ibPs  to  provide  this  information  themselves. 


DAVIDSON:  Could  f  just  jump,.. 


CANADY:  Mr,  Davidson,  sure. 


DAVIDSON;  Perhaps  part  of  the  problem  in  coming  up  with  an  answer  is  that  we  don't  know  exactly 
what  Carnivore  is  doing.  There  seems  to  be  a  certain  subtlety  of  analysis  that  the  FBI  is  seeking.  And 
perhaps  the  FBI’s  interpretation  of  what  numbers  dialed  on  a  telephone  is,  in  terms  of  extrapolating  it  to 
the  Internet,  might  be  different  from  what  many  of  us  would  think  it  would  be,  J 
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And  m  the  interests  of  time,  fit  try  to  be  very  brief,  too.  I've  got  two  technical 


questions  also. 


Ajti  I  rni^vT^w’lh1.*156  P??slbil*ly  °^ynS  something  similar  to  Carnivore  on  an  open  source  basis 
S32^?albVe  S  SStiS?? '.*?*'?“  «*-«f P»»W  Wouldn't  that,  in  effefl  m S 
Carnivore  sysle^sol^ul^up^btto^t^bo^^lntemrt?111^  ‘  ”*  “  “  Radte  aaCk  md  *»  «  > 

SKKs  tKS ailir^ht”  ed  S*  “  lh“  ?f  “lvorf  W'“  »  be  fwclionally  similar  to 
today.  He  special  p™iT^,P^27^.CfX^,™S’“a<m8  meml  *¥  &ee  0Pmttoe  */»«■* 
ffi^goutU^ 

and  also  that  it  can  monitor  hitler  speed  networks.  And  I  believe  that  that’s  nrobabl  v  a  u  UL 

of  the  proprietary  code  is  is  in  the  very  high  speed  monitoring  probably  where  a  large  part 


£§Sp2d  ^ that  S  Pr°bab1y  Wh8re  3  l3rge  m  0fthe  P^Pnetaiy  code  is,  is  in  the  > 


very 


But,  as  other  people  have  mentioned,  the  idea  is  to  neck  all  of  the  laree  nines  rfnwn  in  •  i 

5SBT  ^  And if  ,sp  c” d0  ,ta  +y  *-»  "«i  E  3B3K3K2S&F 

And  I  diink  Matt  has... 

nitwf  « l— S; 1  address,ed  ,some  of£his  in  my  written  testimony.  But  the  important  noint  h  that  awc 
2SS fTT  f  °Ui  ^e>asic  functionality  of  network  sniffm.  'Tta^SSSfitod  used W* 
anyone  who  has  to  administer  a  network,  such  as  an  ISP  or  a  local  -ire's  t  I •  . *  usedr^ 
are  common  place;  they’re  widely  available.  '  rl  admmistrator-  tools 


ht^^web.texis-nexis,coindn.i»?i^ii5s0bcf385a4517$2T6|lsfae73f5|gg|^,iS? 
q““ti0n  abOU‘  ISPs  <”  d0  »*“  C-rolvorc  *»  until «, 

CANADY:  Well  I  understand  that.  But  I  also  understand  the  FBI’s  problem  with  making  the  ^ 

SfeM1 may' b*1 *«< 

And  I  recognize  the  gentleman  from  North  Carolina,  Mr.  Watt 
WATT:  Thank  you,  Mr.  Chairman. 
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don  t  pro\  tde  additional  interception  capabilities,  but  ratlter  provide  these  Jeeal  assurances  and  chains  of 
aid  “b“d%^  °P“  “““  W0UW  b'nefi‘  gr“,y  *>””  *“*  to'  »™Mn't  FovHe 7ny^ft 


WATT:  Mr.  Baker,  it  looks  like  you... 

h&V-n  f  *fy 1  “k&e  FBI  is  right  on  this.  If  you  publish  exactly  bow  you're  filtering  this 
JSSwmeS?  °  Wnte  th6Ir  e'IBS!l  addr£SSeS tod  sP°ofth^ addresses  m  ways  to  afoid  that 

It’s  really  not  the  best  idea  to  publish  this.  I  think  the  likelihood  that  the  public’s  -  the  open  source 
community  is  going  to  embrace  Carnivore  as  a  project  is  about  zero.  There  are  Going  to  fee  vSy few 
benefits  from  doing  that  and  a  lot  of  costs.  b  h  DC  verj  IeVt 


m!sfd  an  lssuc  {|iat  1  want  t0  not  have  him  address  because  he’s  already 

Mr  DavSm?  matbe  ^  address  k’ but  Blaze  and  Mr.  Perrine  and 

remotely^  ’  >b  M  *  S  h  * M  Com'Revere  ra,sed  the  prospect  that  Carnivore  could  be  accessible 


1  tltink  1  understand  what  that  means,  that  you  could  -  the  FBI  could  sit  in  an  office  somewhere  else  and 
m^Revem?^111  ^  mantPu!ate  «  from  some  remote  location .  That’s  what  you  intended,  Mr. 


CQRN-REVTSRB:  Thafs  correct 


££?&■ ^  £?* since  Mr-  Cm*n” docsrfi  *• 

PERRINE:  Actually,  I  believe  that  is  the  case, 

WATT:  It  can  be  remotely*,. 


answer 


PERRINE:  I  believe  that  is  the  case,  1  had  a  very-  limited  time  to  see  it,  but  I  believe  that 


is  true. 


WATT:  Mr.  Blaze? 


preciselv  vvhat  ?  b* md  necessU>’ to  be  remotely  controllable  and  configurable  is 

SotentSlv  Jfinf !  h  cof  Puter  sscunty  community,  are  made  very  nervous  by.  That  capability 

%  impkmeTlted  ver>'»  vei>'  carefully,  could  allow  an  external  attacker  -  third  party  -  to 
gain  control  of  the  system  and  potentially  do  quite  a  bit  of  damage.  party  to 

WATT.  Mr.  Davidson,  Mr.  Sachs,  if  you'll  address  that  same  question  quickly.  Til  leave  everybody  else 
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*  ”  *  ,  „  ,  .  ?  - - “Jr  w  **  tvvWftij  Ud-Sio*  Lilt?  liivt  Ifll 

Carnivore  machine  is  going  to  be  out  there  accessible  remotely  means  any  hacker  can  get  into  a  system. 
If  they  could  get  into  the  White  House  and  hack  that  site,  they  can  get  into  an  ISP  through  Carnivore. 

SmnI!iSS:S^gnlg  configurations  remotely  to  the  extent  that  ifs  possible,  I  mean,  I  think 

inSSSE™  Ef wfriSt  d  hopefully  think  exists  where  an  ISP  at  least  is  in  some  ways  an 

intermediary  of  how  the  device  is  deployed.  And  so  that  raises  another  concern, 

WATT:  Thank  you,  Mr,  Chairman. 

CANADY :  The  gentleman's  time  has  expired. 

The  gentleman  from  Alabama  is  recognized  for  five  minutes. 

BACHUS:  Thank  you. 

a”y  ru?nale,that  aRy  of  you  can  think  of  why  electronic  mail  or  information  traveling  over  the 
pnvSe  maii?  d  *****  **“  protectl0n  lhan> say’ 3  Person’s  telephone  calls  or  their  faxes  or  either  their 

■4 

:  N°'  E°  the.contrary.  I  think  that  in  fact  it  should  have  at  least  as  great  a  protection  as  we 
currently  give  to  voice  communications  for  example  in  Title  III.  There’s  a  crying  need  reallv  for  the 

S»5SSS  tEif!S^C50mmunic8doas  Privacy  Act  t0  bring  it  into  line  with  the  expectation 
tf  privacy  that  I  think  that  Mr.  Nadler  suggested  and  that  most  of  us  have.  P 

our  moETnrh-atP  Xwuf °Y  m°f  imP®rta,tf  communications.  Involves  our  most  sensitive  data  and 
our  most  pm- ate  thoughts.  And  we  do  need  to  bring,  those  into  line, 

Srnf™lrnli°n  “ if  1  Cai]  forjUst  8  second  ~ the  administration,  I  think  partly  in  response  to  the 
Carnivore  controversy,  made  some  suggestions  the  other  day.  Mr.  Podesta  made  some  monosak  In  mv 

loSthat  6  g°ne  °Ugh  th0$C  proposals  in  some  detai!-  a  moment,  I  urge  you  to  take  a 

8  poillIf 115056  P^posals  are  not  a  solution  to  the  Carnivore  problem. 

SkfffthS it tiie  ™appmg  laws,  doesn’t  get  to  the  heart  of  the  Carnivore  problem, 
wmich  is  that  it  is  a  device  that  does  allow  the  FBI  to  filter  through,  potentially  to  canture  hove  volume 

of  communications,  most  of  which  are  completely  unrelated  to  the  target  of  ttie  investigation  8 


force  a  service  provider  to  install  a  device  like  Carnivore. 


I 

authority  to 
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BACKUS:  Mr.  Davidson? 


DAVIDSON:  In  the  interest  of  time,  Fd  just  like  to  sav  ditto  And  orf/f  «n*  n*w  *„u;~u  •  <u  . 
really  Just  the  tip  of  the  iceberg  here.  }  ‘  And  add  one  Pom(’ which  IS  th«  e-matl 


IS 


toW.^f*«5?*  part  °-the  p0mt  1  **!  t0  m2ke  k  that  the  home  has  explored;  tilings  that  we  used 

°f  0nt0  a  netWOrk'  ^ *M»  h  a  *w£>  ftaft  only 

S^S2SSSS?SSSSi5SiSSSl£^^  ^cwt^ur  ^  &n« 

greatly  diminished  I  SKil 3H  ff essi0?’  th«^  of  protection  is  has  under  the  law  Is 
Sth  that  &  1 7  h  chaIknge  here  for  tbs  Congress,  to  think  about  how  we  deal 

Anyone  else  wish  to  comment  on  that? 

I  read  a  question  to  the  first  panel  which  was  that  you  can’t  go  to  the  AT&T  and  sav  We’re  mhn  *„ 

sys,em- 1  thai's  “*•  "«*»  &>■*  *>  lu,  isn't 

telephone  provider  and  install  a  Carnivore  Hi r#*  *u,V  ^  it  could  not  go  to  a 

was  settled  30  yea*  "go  and  hefS  SS  ’  UKl  *a‘  ^  P"™C  refeTO‘l  He  said , ha, 

lhe  ‘f«^asis  fer  'h«  to  an  Internet  sendee  provider  is  at  least  eouallv 
suspect,  out  it  may  take  an  act  of  Congress  to  clarify  that  point,  equally 


BACKUS:  I  think  clearly  the  marketplace  and  technology  has  outrun  the  law  and  in  dnin*  ™  w 
our  legal  protections  that  have  been  in  the  law  for  years  *  W  domg  has 


>  overrun 


iSSSfr™??  experiences,  what  procedures  are  typically  followed  to  notify  customers 

JAR£R:  ^*aj!s  a  vefy  mixed  bag.  And  it  depends  entirely  on  the  policy  of  the  ISP  Some  TSP*  have  a 
policy  of  sending  notice,  others  do  not.  There’s  no  requirement  ene  my  22o£t 

s”*es  or  nfro  nS£.The  P,°iMy  Sh°”“  *»  *«""«  «• »tar  U,a„ 


BACKUS:  It’s  my  understanding  that  what  they're  saying  is  they  don’t  have 


to  give  notice  if  there’s  a 
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exPectstion  *^8t  ift^fy  8ave  notice  the  communications  would  stop.  And  I  think  in  ev&rv  «w 
here  they  gave  notice,  it  would  he  a  reasonable  expectation  that  the  communications  would  stop,  so, 

y°U  kn0V'j  m  some  circumstances,  we  have  delayed  notice,  and  I  think  that  that  serves  a 

t£  vou  Xw  fhSt  fe*00' An.  1  th“? {here’51  be  circumstances  where  that’s  appropriate.  At  least 
then  you  know  that  this  had  happened,  you  have  a  chance  to  object  to  it,  even  if  it’s  after  the  fact. 

CANADY:  The  gentleman's  time  has  expired: 

The  gentleman  front  Michigan,  Mr.  Conyers,  is  recognized, 

i 

C^NYBRS.  %  i  begin  by  thanking  this  second  panel,  because  this  has  served  as  a  very  important 
corrective  for  what  we  were  just  told  for  a  couple  hours  earlier.  And  Vm  sorry  to  hear  thafwToSl 
move  very  rEpidlv  on  tins  mutter  h&eaiis**  the*  *<?  mm  tv****.  ^  ^ 


we're  going  to  have  to  indulge  in. 


Let  me  thank  specifically,  though,  the  American  Civil  Liberties  Union  because  thev  in  addiHrm  tr,  *Ki„ 

And  so  I'm  glad 


Is  there  a  feeling  that  we  should  probably  try  to  require  that  notice  be  given  to  those  who  ire  tb*  «k«Wtr 

of  a  trap-and-trace  measure,  or  is  that  getting  a  little  bit  too  fine  -  cutti Zoo fme  a  £  in  the  J 
requirements  on  the  Department  of  Justice?  vumng  100  unea  line  in  the 

Mr.  Cora-Revere? 

S?S!lR|VERE:  Jet  R>eiU8t  that  question  in  the  context  of  the  previous  one  and  that  »  in 

the  ease  of  an  ongoing  investigation,  like  with  the  trap-and-trace  order  the  ISP  is  exnresdv  5 

mv  estigated,  then  the  communications  wall  cease.  So  there’s  no  notice  before  the  fact.  S 

bC4?ViSaue  al  }fst  t0  Cbmgc  the  Iaw  80  that  anyone’s  who's  been  the  target  of  a 
surveillance  be  notified  after  the  fact,  as  currently  is  the  case  with  respect  to  a  Title.III  intercept  order. 

1  vTld  juSt  -add  ** 1  actuaHy  thh&  to  toe  are  two  mom  important  thincs  for 
Internet.  secona  18  aeRnm8  what  trap-and-  trace  and  pen  register  mean  for  the 

because  there  s  no  reasonable  expectation  of  privacy  on  that  information.  ’ 
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Smith  SjSXd 0% otelSflfi1 York-™11  tm  rre  rCally  *??  °f  'hem  <ta‘ addre5s  ■<> 

co«  had  to  id  23?  UK  555:  S"£'Sg  to»Sny'  “ s  ,0  "tai 

™“2*  fo,” “f»?W  oould  not 
hear  sound.  They  disclose  only  the  teSrne  1SET? alK”.' “?«'■  ”**  devtces  do  not 

commumoatta.  Neither  the  report  of  ly  communicate  beS^St' “te  £S  redSSfeal. 
their  identities,  nor  whether  the  call  was  even  completed,  is  disclosed  by  pS  retire  P  °f ' lhe  CaI1’ 

s  from  tlie  kind  of  information  thafs  acquired  with  resneer  rh 

of  many  otte^e'ojrfe  w?h  e-mtolXelSy,'if  yS'ahto  to  OTl!5  ^>ES  1°d  f“'S  "f  ' 


«?S“th?Ste  Hu  pen*  toste?tXn  ttecf SWe  °r  different  from  what 

ago.  OI  a  pen  register  when  the  Supreme  Court  addressed  those  issues  some  25  years 

fx^SteiSSfo^S*’  **■  COn5,m-  ,h“k  y°“  f“  »•«««**  *-  O.  ACUJ,  i'll 

UK  now  for 

d5S,:  oatis its  cmsteta _ Sfe5.s°,t,“  *•  “■»*»“  *• 

a  changing,  because,  as  new  technology  comes  on  -  aref ^reany  “So  w  te  e  ‘  *?  *  comPlex’  I  *f 
of  assurance  that  i,  may  not  he  as  big  fc  i,  secntsto  bShSSSSSl SSSSK ^  WM<ls 

(CROSSTALK) 

CANADA :  The  gentleman's  time  has  expired. 

And  the  gentleman  from  Arkansas  will  be  recognized. 

HUTCHINSON:  Thank  you,  Mr.  Chairman. 
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wfl^f  f  bff  *  during  SO?e  of  tWs  testim°oy}  but  I  want  to  assure  everyone  that  I've  read  vour 

present  during£p?eS  paS  tSSr TSdVd  “  m*? *  *fA  ^re  probably  was 

perhaps  Mr. #tS5  P  tetrmony,  and  Idjust  hke  to  ask  a  genera!  question  to  Mr.  Davidson, 


frourwha^  I  gathered  tomtits  °f  ^  P/eV.i0US  panclJ  rdiust  i&e  to  ask  a  reaction  as  to  ~  r  mean 
Carnivore j^lam to proc^de?by  a^Sn^ 15  *’  ** 01  eve^hfe8  though  to  the 

?SnkS?fo^S?^»d^*&er  &ere  s-h£uId  be  sorae  “dependent  review  of  the  source  codes  And 
i  mm  mats  something  I  had  a  discussion  with  them  on  -  you  know  they’re  soWtormT^T  «,im  . 

«*«•»'<>“*  *loM  b*  sole*,,  otonXs 

<o  .nunimize  it.  And  so,  if  you  could  just  commented  whether  youdiMgree  Of^any^ ofthose^o^lusiOTS? 
Mr,  Davidson? 

totoWhf  2S  stf*  h?  s.&yp&'. 1  think  some  of  those  things  actually  sound  good  And  I  mean  I 

think  the  idea  of  trying  to  minimize  information  that’s  collected  in  ■*  mm  ftr!X  ,  m.ean> 1 
surveillance  is  a  good  tiling.  coiieuea  in  a  context  of  an  Internet,  you  know, 

HUTCHINSON;  And  how  wou!d  you  suggest  doing  that? 

?^»^lS^gS‘£diSiS  e?L^  S*  is,VCTy  11006  r  ■ [f  10  ** * 

opening  if  up  to  the  public.  P  P  here’ that  s  not  die  same  a«d  *  wouldn’t  be  as  good  as 


jr  ■;  — **  z  *  f,vaxw»  m*v«  i  uuiu  k  urniK  it  cm  oe  mat  usemi  a  if  tht*  hvA 

£S2 5  SiS? goh d  can  if  be?  **  Sat  - 

group  in  here  for.  P  g  P  6  ’ But  maybe  that  s  what  we  ^  get  an  Independent 


I  tlmik,  but>  you  know,  from  a  greater  point  of  view,  there's  sort  of  thk  ^ 

this  desire  on  the  part,  I  think  of  law  enforcement  to  be  able  to  extrapolate  everv  current  oanlwitofVp 
pen  registers  or  trap-and-trace  orders  into  the  Internet  world  Thi»  fiw*  «  rf>  *  ent  capability,  like 
them  don’t  translate  very  well.  W‘  ^  f  1S’ that  when  you  do  *at,  some  of 


Pen  registers  is  probably  the  example  we’ve  talked  about  the  most  here.  When 


yon  -  we  don't  know  what 
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tkcy  n  fa  the  Internet  world  when  we  tty  to  extrapolate  them,  we  get  a  tot  more  information... 
(CROSSTALK) 

HUTCHINSON.  \ou  suggest  a  higher  standard  for  a  pen  register  for  Internet  access? 

£^yjPS0N:  Absolutely  a  higher  standard  and  a  clearer  definition  of  what  it  mean*  fw  t  n,t„t  ,t.  . 

got  to  he  an  understanding  that  some  things  they’re  gouts  to  be : S  aT  r  ™  £  1  b  ik  there  §- 
capabilities  that  the  FBI  is  netfintx  aH  I  hoinS  ™  De  ante  to  do  - 1  mean,  there  are  new 

“  <  1 1S  gettwg  311  the  tim&>  because  of  the  sea  of  information  that’s  out  there. 

ussssfa  'ztntsssssi x -‘sssssKis*^  •*? ,o  iw  •»  *  • 

not  neeessarily  a  horrible  thtag.  There's  going?  be  lots  of  new  took an,* enSeS  t"J "'S 


HUTCHINSON:  Mr.  Stemhardt? 


?2em!fo“ SSh IhMestimMv  5|, "5  f”’™'"'  F™el  «*W «»  questions  than 

Carnivore  is. .« lea’s!?, So Zm«  ndTS  SteZSf  “!*'  *?  ^  #« 

interception  of  e-mail.  a  m  implication  was  to  be  primarily  used  was  the 


demonstrSI;  for  ofthe  pmS  ?“  °fth°*e  - 

Carnivore,  that  it  is  capable  of  analyzing  and  potentially  interceotine  far  mnr2%  -  en?onstratmriS  of 

a  whole  range  of  Internet  protocols  which  Carnivore  is  canS  5  ?  n  n  }  e’raaiK  T1iere  «e 

to  those  here  today.  is  capable  of  filtering  for.  There  was  some  allusion 


HUTCHINSON:  Could  I  interrupt  you  here  for  a  s 


second? 


STEINHARDT:  Yes. 


order  that  testretns  the  use  of  gathering  techniques,  .tad  so  there's  almyl  coSJaces  to  tta.  ““ 
taiwSYcourt'orde^  °f  ,hcse  be  abuKd'  “d  lhe!'  “uid  gather  more  information  but  they're 


STEINHARDT:  No,  no,  perhaps  I  wasn’t  clear  Congressman  Hutchinson. 

“sh  15  se“n,!s’ bec,use 


re  —  we  need  to 


\6M7J 


ft  7& 
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gotten  fifes  through  the  file transfer S«i«SlffoSmaSK?S 2T  ?,f,case  7  had 

Question,  but  I  think  there  are  serious  question  about  whether  or  not  exktxnv  law  «  **?  *!^8e* 

for  example  with  a  trap-and-  trace  order  S  mg  laW  pemj,ts  them  to  8*  that 


HUTCHINSON:  Thank  you. 


CANADY:  The  gentleman’s  time  has  expired. 

The  gentleman  from  New  York,  Mr.  Nadler,  is  recognized  for  five 
NADLER:  Thank  you  Mr,  Chairman. 


minutes. 


I  have  a  senes  of  questions.  I  hope  the  answers  will  be  brief  because  of  the  time  limitation. 

5“  said  bef?f. that  {he  Carnivore  system  is  kind  of  sniffer  system  that  there  are  manv  nth™  m  ,< 
there  So,  you  could  have  a  lot  of  private  sniffers.  How  do  you  -  how  would  we- If  tW , t ?? 

Evened?  “  *“  *"  °finfOT«tion  '’iokling  people's  privacy  ud  how  wotld  we  know  Si, 

pnW  wS?ffl*aveX*S*W „af?eT°nly  “V“i,ab.,e  “ifr“l™gri>m  to  violate  some  one's 
the  haij  part,  getttag  the  sSftiva  “to  do  thSeepSn  "  0V'r th3!  ,rafiic  floW!'  Tha,'s 


NADLER:  That's  what  the  FBI  is 


BLAZE:  Right. 


NADLER:  OK.  Thank  you. 


us  to  let  -  to  mandate  the  ISPs  to  do  in  this  case? 


Ands^  accessibility  of  the  FBI  -  of  the 


Carnivore  system. 


,  change  evidence  and  implicate  so 


a  motivation  to  do 


BLAZE,  ’ft  ell,  the  answer  to  that  depends  on  the  security  of  the  remote  access  mtpm  trtto  ~  ,  .  , 

m  a  secure  manner,  then  the  chances  of  that  are  very  small  If  it’s  lfjts  iroP5emented 

then  the  chances  of  that  become  quite  great...  V  ' U  *  s  ™plemented  m  m  ^secure  maimer. 


InttoS?  Lt£  3SSrme’  Iet’s  asjume  11)31 11)8  P°lk«  were  under  some  -  we  know  that  this  has  hardened 
Se?L  StThd?  ™  7  ?onK1?'?t  i’reS5ure  to  solve  some  heinous  crime  and ftt ST 

=S.  iftT^yed  w”Bt  8,VC  “ llWe  ra0re  evi<,e”“-  Co»M  they  use  ft.  CarnX^S  to.  is 
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fc? ve  JS&?Sl^  &e  mdhS  W  ™pleraente£i  3114  “  0Iie  «W*  masons  that  open 

NADLER.  So,  the  answer  is  yes,  unless  you  put  in  safeguards  to  prevent  it? 

BLAZE:  Yes,  that’s  correct. 


6fa47? 


NADLER:  OK,  so  we’d  have  to  stake  very  clear  that. 

/ 

*£  yo"  say  ">«  S»A  He  _  whatever 

«  only  be  issued  on  the  teis  of  an  i^dSf^Sy’^dS^g^i,^1"  K*" 
to  believe  that  the  target  of  the  order  has  or  is  about  to  coLito  )fthHe  1S  reaso«able  cause 

the  same  thing  as  probable  cause,  or  you  mean  something  difflfentT  B  reaSonable  **“*•  >*ou  raean 


STE1NHARDT:  Well,  it  a  slightly  lesser  standard  that  probable 


cause. 


SfflC  S355JSSSSS S&£  aots^t.1”1™  Mbm 

disaetomOT down  He  rec foeSSSS  Si?  ,1°™ !,?Spi?  ?«‘tiflfa,ion;  the  judge  has  no 


pointed  out,  this  is  an  area  where  people  do  have  a  reasona ^ 
reasonable  expectation.  reasoname  expectation  ofpnvacy  and  ought 


ge  has  no 


ary  cause 
as  you 
to  have  a 


NADLER:  And  you're  suggesting  that  for  the  Internet.  You're  not  suggesting  that  for  telephones? 
STEtNHARDT:  We  believe  -  no,  we  are  suggesting  that  for  the  telephone  context  as  well. 

e^wmbn^fpri vacy  ismore  sub^anlk!  Ha^the^Supreme Court  sewned to  think?!  waszs’yemsgo? 
v  STEINHARDT :  Yes,  I  think  dearly  it  is,  yes. 

NADLER:  Why  do  you  say  clearly  it  is? 


reasonable  expectatfono^^v^infhc  numbed  ^Tdiai'and  iff t0  Jeam  lh?{  the>' don't  have  « 
common  sense.  I  think  the  Supreme  Court  decisiondefies  co^non  °  ^ *  thijlkthat>s 


NADLER:  Mr.  Baker  wants  to  say  something  on  this. 
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been  true  that  you  couidn’tteH  whethenhe  caHwas^omSeSTihT  wrote.  ?5  *****  a8°>  >£  might  have 
course  ofCALEA,  the  FBIhasfS  What  Was  saidand  the  iike-  Butin  the 

gathering  about  calls  other  thS  Sen?  0  a\e,K™^amount of  transactions!  data 

iong  yoif talked,  whether^TO^v^^n^iT^iring^r^lfcra^^ing!011^  trap-and-trace  orders:  how 

NADLER;  Whether  it  was  completed  at  all 


'm  “**  *°‘ oS ■  ">  «“•  Motion  would  be  pat.  of  a 

if 

^  telephones  today,  which  was  not  fee  case  and  may  in  fact  —  so  ?hi*  r  ^  - 

were  the  same  judges,  using  fee  same  reseonmo  m;„u,  ....  , *  i?cl  s,°  me  Supreme  Court,  if  it 

facts  are  different  S  ng,  might  come  to  a  different  decision  today  because  the 


ISS^SixSdCMTOS  d’  e™t“  *  “M«t.  certainly  it 

Congress  s«  fte  S,and”ds  fcr  «** 


md?oS  <•*  P“«l  ta  pmol  in  particular 

untrammeled  discretion,  and  we  cannot  ahvavs  assumed* ^  *  thf,  p0ice  a®encies  cai»ot  be  afforded 
protecting  people's  privacy  *V  assume  tht‘!r  goodw!,!  or  even  their  lack  of  mistakes  in 

CANADY:  Hie  gentleman's  time  has  expired. 

»h 

The  gentleman  from  Georgia  is  recognized  for  five  minutes. 

BARR:  Thank  you,  Mr.  Chairman. 

Carai™« «■ 

SACHS:  Tliat's  my  understanding,  correct. 

BARR:  And  no  supervisory  capability  whatsoever? 

SACHS:  That's  my  understanding,  correct. 

Ss^sals^-^to^a  ve  the^o  vemmemla  v^feat  ^Ubttl did  **J  ^ow  if  did  me  and  1  think  it  did  Mr. 
waffle  just  a  little  bit  -  that,  in  virtually  eve^lnstance  lie'ont  ^!’a{fhough  th^«  of  course,  always 
last  hvo  years  in  which  they  used  project  Carnivorewas  sinmlv  bec\mf?h?Km  "5  U!l^tances  over  the 
could  not  satisfy  feem  that  they  could  provide  the  inibrma 
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ht5»^/web.iat5s*ne9ds>conj/liUBi^^d5H)l}cGOSa45I79276f5fee?2f5{g! 


m 


twhttTiSlmXSSVeT'?‘'S  experie",“  *«  fa  tt«e  other  24  instances,  but 
withthecoun’order^ 

BARR:  That's  my  impression,  too* 


b^su  secS.b3Ck  UP  °n  fte  b°ard>  Mr* Davidson*  “V  one  of  yo«r  examples,  and  III  come  back  to  you 

®Sr^o?sS$4>S  0  ™  of  ”mi «  *>«>.  ™th 

the  Senate  to  amend  Fourth  Amendment  Jaw  thmsinh  „nme  a  ^eir  co  eaF^es  tip  here  in  the  House  and 
bankruptcy  biU,  to  essentially^  SSSST’I"  ^!,afd  (ht 

K£te  mfon””i0"- N-’ "  -  «4  Wi 


ol  die,s,^  of  data  that  the  government  would  consider  intangible  so  that  thev  «uuiM  ;r  *5, 
and  seized  it  somehow,  would  not  be  required  to  tell  you  they  Ve^ aken  it?  *  ulds  if  the-v  carae  m 

provides  them  in  tteway6 o?m  vest  i^torv  fooknev^rV  °  ma*f  crcatiVe  arguments  about  what  the  law 

the  kind  of  information  which  they  will  make  a  claim  i^Snoiw  amaf e  me;  fe*’  *  this  is  exactly 
disclosures.  >  111  maKe  a  cIaim  18  tan&hls  ^  would  be  subject  to  those  kinds  of 

BARR;  I  would  suspect  so. 

JLma  Jb « “«SSSSS  £r  “f  lm  W**8*  --  and  this  may  be  very 

the  target  of  ulat  they  reauthorized  foreceiveor  o^anfe^  inft)tniatton,  if  that  infonnation  is 

“  not.  that  that  means’  that S?  wuld £ Zle  ,o T  fcy  h,ve  to  ea  ta  *here  ,0  «« if  it  is  or  it 
rough  11?  *  wouidalsohave  to  necessanly  m  every  instance  look  at  items  one 


is 

through  1 1? 


SS'to  S k?ta otdenJrid  ftS  faS1ta6A?aS,SPi'C“ ?f 'j"" 0M lhr0UBh  1 1  ”*»' ««» they 
a  web  site,  tnlonnation.  Again,  this  one  is  in  the  context  of  a  communication  with 


But,  yes,  I  think  my  general  point  was  that  they  need  to  look  at  a  fair  jmn,mt  „rfu-  ,  . 

the  analysis  to  figure  out  what  it  is  that  they're  entitled  to  °f  thiS  packet  1 


:  in  order  to  do 
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BARR;  Otherwise,  there's  no  purpose  to  having  Carnivore? 
DAVIDSON:  Exactly. 


you 


this  stuff  somehow,  doesn't  it? 

ISSi  S  oSduXSr  wSStoTow  bow1 ^d?iBeaShi?  “d  °f 

’"*y  we  need  to  have  some  mi  ofrcal  oversight,  becaose  thc£  is  .UftfetavSgata  gSg  o?"  “  “°d 

know  so  little  abou  ttS  andlhe^^lficattoS^ andpofenSf forfbuS””1,  "*  ?  P™1'  furthtt?  We 

il  was,  that,  son  of,  times  a  wasting  aed  we needto S  heS mi KS? tta  “  *?d  I,foi®!t  »*° 
dta.  we  caa  detenttme  to  wha,  =,Z,  we  need  to  ” 

DAVIDSON:  I  think  that  we  would  ask  that  Cantivftw  vAt)  t*™,  ,  ,  .  < 

know,  public  oversight  and  mfimnation  aSm 3S??SS  * 

independent  review  panel  as  a  start,  L  g  00  incre#  At  thc  ver>  least,  some  sort  of 

BARR;  To  at  least  maintain  the  status  quo  without  -  the  pre-  Carnivore  status  quo. 

DAVIDSON;  It's  problematic  enough. 

BARR;  Thank  you. 

CANADY:  Hie  gentleman’s  time  is  expired. 
p£t“prt“odt^^ 

Tile  subcommittee  will  stand  in  brief  recess.  TOs  hearing  has  coacluded. 
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WA  EL STREET JOURNA L 


FBI  Is  Pressured  ® 
To  Discbse  Codes 
For  Carnivore 


date  h/U-i y\ 


RAGE  A <0 


»V  lets  Btmus 
"f  T,MJ  *'*>■>• 

’W^HhCTOK-Tfte  Federal  Burhui  of 

in  dkrtm  T JS  um!er  increaslngr  pressure 
So  disclose  the  secret  blueprints  for  its  Car 
«««  «rw(«a>ce  system  so 

?pem  can  verify  that  the  soft- 
;  “1Wrs  oaS>’  «*  Internet  comnumi- 
cations  of  comma!  suspects. 

rev-Sf  «F 6885  10  Wl  s«cft 
Sfwf®  raataiain  that  dts- 
th.e  softwares  source  code  would 
a?iOH  hackers  to  find  ways  to  defeat  the 

argll{?  tM  smh 
a  oisetare  could  violate  copyright  protect 

S^eCati!LCanjiwe  Eludes  portions 

to  em™  C(rffK  0m  a  pi¥m  leased  t0 
tnegoverament  by  an  unidentified  vendor 

^Congress  is  expected >o  press  senior 
FBI  officials  on  the  subject  at  a  hearing 
today  before  a  House  Judiciary  Committee 
S  by  Rorida  Republican  to 
Seftot  tof *  L1Tn?akm  h3ve  ««H; 

».&s:B«anr 

ssssiir8?* 

.  cw«as®as5a'ssf 

fuJn?  sehed«leti.witnds?for  to  hearinc 
pMatthew  .  Blaze,  an  -AT&T  Coro  rf.’ 

^  failure  to  fully 

d  setee  how  Carnivore  works  has  contr  b 

in  an  essay  published  on  the  Internet 
;  ast  week.  Mr.  Blaze  wrote  that  releasing 
the  system’s  source  code  "is  a  critical  first 

S«»i^  *$£*£ 

to  d0  it  is 

25f  irtoeV;Mr>  £kZe  W***wl  Car- 
iuvdf#  s  effectiveness,  suggiestm?  ths* 

even  modest  electronic  f&  of  dam 
|  it,  and 

*k  or  iDRt>e€at  users 

was  for 

anftffitsfrtss 

feats  $y  describing  m  remarkable  dJtoii 

^SSMSfaSSMS 3 

\™se. 
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USA  TODAY 


Today's  debate:  FBI  and  Internet  privacy 


rm  eavesdrops  on  e-mail 
crashes  privacy  barriers 


j- - .  ►  Why.  The  Congressional  testimony  that 

/^en<y  says  it  targets  criminals.  » revealed  existence  of  Carnivore  also  di$- 

Histoty  Sip  it  cant  be  trusted  ckKed  tw»  «ber  systems  used  by  tt>e  FBI  for 

'  ;  $«wkr  purposes:  •'Omnivore"  and  "&her- 

ihe  FBI  has  a  knack  for  concocrine  minHi  .t  Why  weren'r  those  fevealed  earfer? 

code  names  for  crime-busting  toys  Tli  St-  foS  puSS?  ?  “**  ***”  ^  3nd 

that  devours  private  e-mail  and  sniK  ra  it  in  ^  *  response  to  those  questions  is,  in 

teresttog  parts  SSSS  i  ««"*' trust  ^  «Ve  only  after  criminals 
nais*  e-mail.  Anyone’s  e-mail  *  and  terrorists.  But  even  a  cursory  glance  at 

The  FBI  already  has  attached  Carniu**,  tn  ^''^ciforcei-nent  history  shows  that  prom- 
the  e-mail  hardS  at  somelSemetse  flCan£t  *  b«ttd'  temptation  of  gov- 

vice  providers.  Though  it  won't  say  there  hreSiffsS?  inr°miation  is 
the  FBI  says  the  tod  has  been  used  frwpr  )rrcs^t't,ie'  [See  box,) 
than  25  times.  Once  it's  toffee  Carrie  Further' the  FBI  shows  m  iRdinatkm  to  ex¬ 

acts  as  an  unrestrained  internet  wirenn  j  erase  ,estfamL  in  every  aspect  of  electronic 
snooping  through  every  Internet  »»„]'  ?”vacy  ”  C0IT1Imters.  the  Internet  and  ceil- 

mSSS,™*  fe- *  ,f  ?»“  *»*»« «.  <h 

Be  House  Judiriaiy  Committee  will  hold  a  .  k,  - 

hearing  today,  at  which  it  will  ad-  rt»  fri  tr.  a  n  * ,e  ^  lobbied  to  have  back- 
explain  its  actions.  But  in  the  15  weeks^nee  itl  wefV  new  computer 

Carnivore  was  revealed  to  obscure  !  a  ?  earortiC  SIW0Prog.  allowing  the  FBI 

*~!«to»5(llSZteSSS' 

SfiWtiSSSSS 

tsstssPr^  ““ar^opa. 

privacy  of  innocent  Internet  u<*re  *Tte  to  35  man^  as  onein  100  phones  in 

tontiaJ  for  aSfuSSeS*  ***  ™ZT*  *  *%*  f  «**»  a  public 

►  Who.  Carnivore  is  intended  m  rim.  P^toy.  Lactopg  sudi  technology,  no  totalitar- 

tbmugh  potential  criminals'  £e  traffic  *  m  '"e’ 

after  police  obtain  a  court  order.  But  the  tod  *  h  W9&i the  m.  Proposed  bbersliaifig 
gives  the  FBI  the  ability  to  track  not  i.«t£  £  export  <*  «wjiptt»  programs,  but  only 

individual  named  in  the  court  wrier  but  also  forcomj3inies  that,  under  court  order,  mate 
everyone  who  uses  the  same  server  at  the  availabte  tQ  defeat  the  privacy  pro- 
Internet  service  provider.  At  America  Online  graffiS' After  m° fei3erai  c01^5  shuck  down 
for  example,  that  would  be  thousands  of  the  f)r°posal,  the  administration  gave  up. 
people.  What's  to  keep  die  FBI  fTOm  snooo-  *  ^  tbe  ^  w**  to  court  to  protect 

tng  more  broadly?  Only  its  own  assurance!  3  P^n  tba£  %vou!d  cellphones  to  be 

►  What  Coverage  so  far  has  focused  on  used  by  P°lice  t0  kote  the  positions  of  their 

the  surveillance  of  e-mail,  but  a  program  U5ers.  *^e  case  remains  in  court  today, 

that  tan  snoop  through  e-mail  can  just  as  ►Today,  the  thin  answers  the  FBI  has 
easily  eavesdrop  on  Web  surfing,  since  the  made  public  about  Carnivore  raise  nJCfe  <&- 

nfonnatton  travels  to  similar  fomis  over  the  turI*lg  questions.  An  explanation  of  Caml- 

ame  servers.  Wliat  information  will  the  FBI  wre  m  the  F8t>s  Web  site  casually 
»tect  about  the  sites  people  visit  and  even  <*tsctesses  the  electronic  surveillance  Of  an 
he  ads  they  elide  on?  entire  “facility,’  without  explaining  liow 

►  Mien.  The  FBI  admits  that  Canuvore  is  broad  *>*  e-snooping  could  be. 

nae  invasive  than  a  conventional  phone  •  !n  each  case>  *e  £e£s  convenience.  The 


gives  the  FBI  the  ability  to  track  not  tost  tte  T  export  »«««*«  programs,  but  only 
indindua!  named  to  the  court  onto  but  alro  forcompanies  ti,at*  order,  mate 

everyone  who  uses  the  same  server  at  the  availabte  *keys"  »  defeat  the  privacy  pro- 

Internet  service  provider.  At  America  Online  graffiS' After  wo  federai  courts  struck  down 

te-  example,  that  would  be  thousands  of  tiK  tbe  administration  gave  up. 

people.  What's  to  keep  die  FBI  from  snooo-  *  ^  *937.  the  FBI  went  to  court  to  protect 
tog  more  broadiy?  Only  its  own  assurance!  a  P*30  tbat  allow  cellphones  to  be 

►  What  Coverage  so  far  has  focused  on  used  by  P°l  ice  t0  kote  ^  Positions  of  their 

ore  surwillance  of  e-mail,  but  a  ptosram  U5et5'  ^  case  romains  to  court  today, 

that  tan  snoop  through  e-mail  can  just  as  ►Today,  the  thin  answers  the  FBI  has 
easily  eavesdrop  on  Web  surfing  since  the  made  pubtic  about  raise  mere  dis¬ 
information  travels  to  stoitlar  fomis  over  the  turt*5g  ^uestforts- M  ®q>lanatfon  of  Cami- 

same  servers.  What  toformatfon  will  the  FBI  wre  m  the  F8I’S  Web  site  easily 
colfert  about  the  sites  people  visit  aid  even  discusses  the  electronic  surveillance  6f  an 
Ithe  ads  they  dick  on?  '«#«*  “fadfity,"  without  exfMning  how 

i  ►  Whea.  The  FBI  admits  that  Camtvore  is  broad  such  e-snooping  could  be. 
pore  invasive  than  a  conventional  ohone  1  to  eaci»case.  th«  fBi  gets  convenience.  The 

Jitap.  k  feces  no  more  restraints  than  riiose  1  Pi^icgets  government  intrusion  on  a  scale 

that  protea  telephone  conversations,  whldi  ‘  ^equaled  to  consfirutianai  history.  Abuse 
are  themselves  inadequate.  Since  Carnivore  w!!  35  foss-ciosely  watdted  law 

^a  greater  threat  to  privacy,  shouldn’t  there  J  enforrcmm  aSendes  Payback  on  the 

oe  mere  teorktiOEis  on  wtoen  it*s  used?  j  tedmotogy.  " 


DATT  ~  tMtQO 
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E-snooping  grows 

Court  orders  hr 
Africa  Online 
customer  dam: 

1  ■-  AS  «f  Jttty 

itKW,  AfX  Had  it  Pet  vf  (f  T'? 

eiscKC'  joy  f 

Sdfoftw:  U$A  TODAY  ***** 
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FBI  fumbles  privacy 

The  FBI  has  a  long  history  of  violating 
the  pnvaey  of  US.  citiaens,  often  with 
political  motives.  Scree  examples: 

►  1956:  The  FBI  rifled  credit  files  and 
criminal  records  of  43  ordinary  Dela¬ 
ware  citizens  ailed  to  jury  duty  m  a  po¬ 
litically  sensitive  case.  Many  also  were 
investigated  for  ties  to  the  NAACP. 

►  1960s:  FBI  wiretapped  Martin  Lu¬ 
ther  lung  Jr.  to  gather  damaging  in¬ 
formation  on  extramarital  affairs. 

.  ►  1970:  FB!  sent  damaging  informa- 
tton  on  NAACP  chief,  Rev.  Ralph  Aber¬ 
nathy,  to  Vice  President  Spiro  Agitew. 

►  I98Gs  and  ’90s;  raj  kept  a  fife  on 
AIDS  activist  group  ACT  UP  and  its 
planned  protests. 

►  1993  and  *94:  The  FBI  "inad¬ 
vertently"  released  files  containing  un¬ 
substantiated  allegations  on  numerous 
Republicans  to  fowdevel  political  ap¬ 
pointees  of  the  Clinton  administration. 


Attorney  General  Janet  Re®:  saw  last 
week  that  she  intends  to  begin  a  thorough 
review  or  Carnivore.  That's  a  positive  step, 
but  it's  hard  to  understand  how  Reno 
wouldn't  already  have  a  Complete  knowl¬ 
edge  of  the  tool  since  she  is  the  head  of  the 
"President’s  Working  Group  on  Unlawful 
Conduct  on  the  internet,"  which  just  com¬ 
pleted  its  report  in  March.  ' 

The  Clinton  administration  greeted  howls 
about  Carnivore's  reach  with  a  proposal  to 
update  electronic-privacy  laws,  although 
congressional  Democrats  say  rite  bill  has  no 
chance  of  even  being  voted  on  this  year. 

The  time  for  such  updating  and  review 
was  before  Carnivore  was  used.  Carnivore 
needs  to  be  shut  down  until  an  outside  re¬ 
view  of  its  capabilities  and  safeguards  is 
complete.  And  the  Internet  companies  that 
willingly  complied  with  the  FBi’s  use  of  die 
technology'  to  the  past  need  to  come  forward 
and  tofctm  individuals  whose  e-mail  the  FBI 
“filtered," 

(  Of  course,  law  enforcement  agendes  can- 
,  nor  operate  without  ways  to  monitor  the 
,  modem  communications  tools  of  criminals  i 

jaretyonerfseapefority. 

~2ioc 


1 


£  '!  ^  °f  Hw  innocent  to  be  free  from 

Vi>f  government  intrusion  should  not  be  com-  Visa/ 
promised  to  make  fife  easier  for  tire  FBI  Unt  il 
the  bureau  can  show  that  its  new  technology 
poses  no  threat  to  the  public.  Carnivore 
needs  a  starvation  diet. 


Technology  used  narrowly 

Opposing  view:  — — 


By  John  L  Colimgwood 

First  lets  get  the  facts  straight.  The  FBI 
and  all  other  law  enforcement  agencies  can 
intercept  e-maiis  only  pursuant  to  a  court 
order  signed  by  a  judge  who  is  satisfied  t  hat 
the  government  has  demonstrated  probable 
cause  that  a  serious  crime  Is  being  or  has 
been  committed,  that  the  e-mails  wilt  be 
about  that  crime,  and  that  the  interception  is 
necessary  to  obtain  evidence  about  the 
ctime. 

Conducting  an  intercept  beyond  that  is  a 
federal  crime  subject  to  severe  criminal  and 
civil  sanctions.  Hie  entire  process  requires 
continuous  reporting  to  a  court  and,  of 
course,  ultimately  is  subject  to  vigorous  chal¬ 
ky  by  defense  attorneys.  Even  when  only 
address  information  is  sought,  a  court  order 
is  still  required 

What  does  "Carnivore"  do?  In  the  simplest 
toons,  it  ensures  that  only  the  exact  comma- 
notions  authorized  by  the  court  to  be  in¬ 
tercepted  are  intercepted.  So,  for  example,  If 
a  court  authorizes  only  the  interception  of  e~ 


mail  to  the  exclusion  of  all  other  communi¬ 
cations,  regardless  of  whom  send  s  them  a  nd 
where  they  are  going.  Nothing  else  is  mon¬ 
itored  or  collected,  and  everything  collected 
is  supervised  by  the  court 

When  is  Carnivore  used?  It  is  used  only 
when  m  Internet  service  provider  cannot,  on 
its  own,  effect  the  interceptions  consistent 
with  a  narrow  court  order.  Accordingly,  it  has 
been  used  very  few  times,  predominately  in 
terrorism  cases. 

In  1968,  Congress  spelled  out  strict  re¬ 
quirements  for  interceptions.  Carnivore  sim¬ 
ply  ensures  that  law  enforcement  agencies 
comply  precisely  with  those  requirements  as 
technology  advances.  We  understand  why  1 
certain  segments  oppose  this  court-super¬ 
vised  technique  But  since  1968,  because  of 
this  law,  many  lives  have  been  saved  and 
thousands  of  drug,  dealers,  terrorists,  child 
predators  and  spies  are  in  jail. 

Hie  chai  rman  of  PSINet  laid  out  the  appro¬ 
priate  challenge  He  does  not  warn  to  see 
Carnivore  on  his  network  unless  vve  can 
prove  It  collects  only  the  traffic  from  the  tar¬ 
get  of  a  court  order.  That,  of  course,  is  pre¬ 
cisely  what  Carnivore  -  does,  electronically 
protect  the  privacy  of  tho&e  not  subject  to 
the  court  order. 


mail  from  a  particular  drug  dealer  to  another  John  £  Coli'mgmod  is  an  assistmtdirectw 
drag  dealer,  this  system  captures  only  that  e~  of  the  Mem!  Bureau  of  investigation. 
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July  24,  2000 


Mr *  Brian  Gal 1 agher 
Editor  of  the  Editorial  Paqe 
U&V  Today 
1000  Wilson  Blvd. 

Arlington,  VA  22229 

Dear  Mr,  Gallagher: 


In  response  to  today's  editorial  about  "Carnivore  " 
again  let's  get  the  facts  correct, 

PSA  Today  rightly  points  out  that  "law  enforcement 
agencies  cannot  operate  without  ways  to  monitor  the  modern 

communications  tools  of  criminals"  but  then  questions  who . 

should  ensure  that  privacy  is  properly  protected.  The  simple 
answer  is  the  same  as  it  has  been  for  over  30  years- -federal 
judges  All  of  the  federal  criminal  and  civil  sanctions  Jnd 
juuicial  oversight  that  apply  to  wiretapping  and  have  ef fee- 
lively  protected  those  not  the  target  of  s  court  order  apply 
to  the  use  of  Carnivore  to  intercept  the  e-mails  of  criminals 


,  Unlike  as  the  editorial  reflects,  howe'ver,  Carnivore 

aoes  not  snoop  through  every  Internet  communication,  does  not 
spit  out  everyone's  e-mail,  and  is  not  an  unrestrained  Internet 
wiretap.  Court  orders  authorising  the  intercept  of  criminals* 
e-mails  come  only  after  rigorous  review  and  the  conclusion 
that  there  is  probable  cause  that  a  crime  is  being  or  has  been 
committed,  the  e-mails  are  about  or  in  furtherance  of  that 
cPme  *-ke  intercept  is  necessary  to  gather  evidence  about 
the  crime.  The  orders  are  specific  as  to  whom  and  what  can  be 
intercepted  and  then  the  courts  supervise  the  interception  to 
ensure  compliance.  Evading  those  court  orders  is  aseribus  crime 
which  would,  ot  course,  produce  absolutely  nothing  of  evidentiary 


Finally,  the  editorial  says  the  "Bureau  won't  answer 
even  the  most  basic  questions  about  whom  the  technology  targets 
a  ■  how  it  protects  the  privacy  of  innocent  users,"  Contrary  to 


1  -  Mr* 


JBC ; mmc 


Pickard 

Kerr 

Parkinson 
Col ling wood 
(8) 
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Mr.  Brian  Gallagher 


that  assertion,  however,  the  FBI  has  shown  the  system  to  and 
answered  these  questions  for  dozens  of  people  on  Capitol  Hill 
and  over  30  reporters  representing  25  media  outlets.  USA  Today, 
of  course,  was  invited  and  today  we  are  anxious  to  present  it 
at  an  open  hearing  before  a  congressional  subcommittee.  We  are 
arranging  for  an  independent  review  as  well. 

'  Sure  Carnivore  can  be  controversial  and  clearly  is  ill- 

named.  But  it  is  used  only  pursuant  to  court  order;  has  been 
used  sparingly,  predominantly  in  terrorism  cases,  and  then  only 
when  an  Internet  Service  Provider  cannot  on  its  own  comply  with 
the  court  order;  and,  when  used,  collects  only  what  the  law 
authorizes  and  the  courts  instruct  be  collected- -evidence  about 
serious  crime  that  cannot  be  otherwise  gathered. 

Sincerely  yours, 


John  E.  Colli ngwood 
Assistant  Director 
Office  of  Public  and 
Congressional  Affairs 
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Carnivore  might  sound  hu  a 
particularly  violent  computer 
game,  or  perhaps  a  movie  that  you 
wouldn't  let  your  t^year-old  go 
see  alone,  It's  actually  a  proj¬ 
ect  of  the  which,  de¬ 
pending  on  your  out* 
look,  is  either  a  threat  to  Jflr 
the  privacy  of  all  Ameri*  Hgsr 
cans  or  a  useful  tod  in 
fighting  criminals. 

The  unfortunately  named 
program  (the  FBI  fits  been  trying 
to  come  up  with  something  else 
since  news  of  its  existence 
broke)  is  an  eaves dropping  de¬ 
vice  headed  in  a  tangle  of  elec* 
trono  the  size  of  a  laptop. 

The  agency  wants  to  deploy  Car¬ 
nivore  boxes  at  the  main  comput* 
ers  of  all  Internet  service  providers, 
to  provide  an  efficient  way  for  the 
FBI  to  conduct  coon-approved 
wiretaps  on  e-mail  in  an  era  when 
all  rommunicarion,  lawful  and  oth* 


mvise,  is  going  digital. 

Since  word  of  this  hit  during  con¬ 
gressional  testimony  the  nation  s 
privacy  advocates  have  been  out¬ 
raged  at  the  Idea  of  the  Inremer  be- 

n|ut  'M  not  just  activists  who  ate 
up  in  arms.  So  b  the  Republican 
leadership  m<t?r^ess;4feuse-Ma*- 
jority  leader  Dick  Armey  of  Texas 
has  attacked  Carnivore  as  being  il¬ 
legal  under  current  wiretap  law's, 
and  the  Const kution  subcommittee 
of  the  House  judiciary  Committee 
held  hearings  Monday  to  look  into 
the  matter 

Now;  privacy'  advocates  have 


ty  Qw(*>  U4A  TQ04V 


been  fighting  for  years  to  protect 
our  infonmato  from  prying  eyes. 
But  iCs  fascinating  to  see  everyone 
else  getting  into  such  a  lather  over 
a  system  that  -  unless  the  FBI  is  ly¬ 
ing  through  its  teeth  -  is  very  lim¬ 
ited  in  what  if  s  allowed  to  do, 
-Tn  ^-perfect*  world.  1  might  be 
concerned  about  the  foea  that  were 
1  the  subject  of  an  investigation,  the 
FBI  could  monitor  my  e-mail  But 
agents  would  a  t  least  have  to  go  be¬ 
fore  a  judge  and  get  permission. 
And  even  at  the  height  of  govern¬ 
ment  surveillance  during  fife  Mc¬ 
Carthy  era.  the  number  of  people 


eiife 

By  Elizabeth  Weise 

being  monitomd  numbered  weS 
under  1  milfoa 

That  pales  in  comparison  wish 
wbafs  already  happening  with 
every  keystroke  we  make  as  we 
winder  the  commercial  Web, 

,  Many  sites  record  every 
|k  search  made  and  every 
mouse  tkk  buMng  up  a 
defiled  dossier  of  interests 
^  and  surfing  choices,  whkh 
they  use  to  target  the  ads 
that  appear  on  our  semens. 
A  fair  number  also  “bug" 
■V  their  sites,  scattering  invisi- 

Jbie  oxides  that  our  brows¬ 
ers  pick  up,  allowing  that  site 
and  others  to  share  informs* 
to  to  create  an  even  more 
specific  portrait 

<***  In  additm  by  linking  to 
outside  databases,  It's  pos¬ 
sible  to  attach  that  portrait  to  a 
name,  address  and  personal  data, 
including  what  stores  you  shop  ai 
what  you  buy  and  when  you  pay 
your  bills.  And  let's  not  forget  that  if 
the  company  goes  out  of  business. 


It  can  try  m  auction  of  its 
to  the  highest  bidder  -  th 
government  we  so  fear  is 
on  making  that  legal 
All  that  t $  bad  enough, 
nothing  compared  with 
happen  when  the  Vkh ; 
less  and  we  aH  begin  acc 
e-mail  bank  accounts  ar 
funds  from  cellphones, 
thought  a  cookie  or  two 
Erosive,  wit  tBI  everyth! 
is  finked  in  real  tune  to  y 
number  and  exact  physi 
don,  as  cellphones  soon  w 
This  isn't  to  say  C 
shouldn  't  be  carefully  mor 
that  we  should  mist  the 
because  tt  tel is  us  to  J  just  < 
dersrand  why  so  many  of 
pie  up  in  amts  over  Cam 
against  passing  any  kind 
protection  for  consumer 
online,  saying  the  indusn 
veiop  only  if  it's  left  to  sel 
When  it  comes  to  the 
my  personal  tnformafio 
the  government  which  is 
stria  laws,  a  whole  lot  roo 
trust  multinational  corpon 


J2. 
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FBI  defends  e-mail  surveillance  tool 


By  Kevin  Johnson 
USA  TODAY 

Wjmrn®m~Peppzm!i*m 

questions  from  skeptical  iawmak- 
ers,  the  FBI  played  down  concerns 
Monday  that  its  e-mail  surveillance 
pn>£nm  known  as  “Carnivore" 
could  be  used  to  eavesdrop  on  the 
Innocent 

At  a  House  judiciary  subcommit¬ 
tee  hearing  that  seemed  to  capture 
torn  the  promise  and  pitfalls  of 
new  technology  for  law  enforce¬ 
ment  Assistant  FBI  Director  Donald 


surveillance  done  with  the  Carni¬ 
vore  program  Is  limited  to  those 
suspects  named  in  court  orders. 

Critics,  including  an  unusual  to- 
alirion  of  conservative  Republicans 
and  aril  liberties  advocates,  have 
complained  that  the  program  could 
hejjsed  to  do  broad  surveillance. 

Their  fear  stems  from  the  way 


the  FBI  implements  the  test- 
wiretapping  system.  Carnivore 
works  through  a  suspect*  internet 
semee  prwden  such  as  America 
Online.  It  allows  Investigator  to 
identify  and  view  a  suspect's  e~ 
mails  amohg  all  e-nuBs  moviiw 
through  the  providers  system. 

Critics  are  cnnaemed  about  giv¬ 
ing  law  enforcement  access  to  the 
e-mails  of  innocent  people  as  well 
as  suspects.  Mtim&i  Cmemt 
can  retrieve  any  e-mails,  investtea- 
tors  are  restricted  to  those  that 
have  been  approved  for  monitoring 
by  2  judge. 

House  judiciary  Committee 
Chairman  Henry  Hyde,  R-ilL,  said 
the  Carnivore  debate  reflected  an 
ongoing  tension  between  law  en¬ 
forcement  and  individual  rights, 

Tou  can  understand  people’s 
concerns  for  privacy?  There  are 
people  who  are  skeptical  about  this 
culture  of  privacy  and  how  porous 
it  IS,"  Hyde  told  Kerr  and  ocher  FBI 


cfffciais  stthe  House  hearing.  i 
Meanwhile,  Rep,  j£  Watts,  R- 
01%  utged  a*  CBittoti  admiaii- 
straSon  to  suspend  the  program, 
tinder  which  the  FBI  has  intercept¬ 
ed  e-mails  in  25  probes  ever  the 

ftoef  11/.  _ _ 


Justice  Department  officiate  also 
$md  they  are  reviewing  me  pro- 
to  make  sure  that  federal 
ngems  have  nor  been  involved  in 
unlawful  eavesdropplr^  Kerr  said 
investigators  involved  in  the  Carni¬ 
vore  program  have  never  been  pro¬ 
vided  Internet  traffic  outside  the 
scope  of  their  probes  :  "We  don't  do 
hmd  seances  (on  internet  traffic) 
and  surveillance  that  is  not  autW 
naed  by  coon  order,1* 

This  year,  the  program  has  been 
used  in  16  cases:  six  criminal 
probes  and  10  national-security  in-  * 
vestigations. 
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July  25, 2000 


Ms.  Christine  Bertelson 
Editor  of  Editorial/Opimon  Page 
St.  Louis  Post  Dispatch 
900  North  Tucker  Blvd 
St.  Louis,  MO  63101-1099 

Dear  Ms.  Bertelson: 

In  response  to  your  recent  editorial  "Silent  cybercrime  hunting,"  a  few  additional 
facts  might  help  your  readers  understand  the  safeguards  and  judicial  oversight  applicable  to  the 
interception  of  e-mail  on  the  Internet. 

As  always  happens,  dangerous  criminals  and  terrorists  use  new  technology  as  fast 
as  anyone  does.  So  now,  instead  of  telephones,  we  increasingly  find  criminals  communicating 
by  e-mail  in  furtherance  of  their  crimes.  We  have  seen  this  in  everything  from  child  pornography 
to  terrorism.  That  is  why  the  FBI  developed  the  Carnivore  program,  a  tool  that  permits  surgical 
in  terceptions  in  the  midst  of  the  flood  of  data  on  the  Internet. 


To  use  Carnivore  to  obtain  a  criminal's  e-mail,  the  FBI  first  must  successfully 
demonstrate  to  a  judge  that  there  is  probable  cause  to  believe  that  a  serious  crime  is  being  or  has 
been  committed,  the  e-mails  are  about  or  in  furtherance  of  that  crime,  and  the  interception  is 
necessary  to  gather  evidence  about  the  crime.  It  is  the  same  rigorous  legal  standard  that  applies 
to  the  interception  of  telephone  conversations.  The  same  severe  criminal  and  civil  sanc  tions 
apply  to  any  misuse  as  well,  and  the  whole  process  is  supervised  beginning  to  end.bv  the  federal 
court  issuing  the  order.  Finally,  the  use  of  this  evidence  and  the  method  of  collection  are  always 
subject  to  vigorous  challenge  by  defense  lawyers. 


The  FBI  only  uses  Carnivore  when  an  Internet  Service  Provider  cannot,  on  its 
own,  provide  the  very  limited  information  authorized  by  courts  to  be  intercepted,  e.g„  e-mails  to 
and  from  two  drug  dealers.  That  is  why  it  has  only  been  used  25  times  since  it  was  developed 
and,  in  these  cases,  it  was  used  with  assistance  from  the  Internet  Sendee  Provider. 


1  -  Mr.  Pickard 
1  -  Dr.  Kerr 
(f)-  Mr.  Parkinson 
1  -  Mr,  Collingwood 
JECrramc  (9) 
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Ms,  Christine  Berteison 


Finally,  Carnivore  does  not  "automatically"  search  for  "key  words  among  all  e~ 
mati  traffic."  It  does  not  search  the  content  of  e-mail  at  all  To  search  as  the  editorial  suggests 
would  be  contrary  to  federal  law,  subject  to  severe  criminal  sanctions  and  produce  nothing  of 
e  videntiary  val  ue  because  it  would  contravene  the  parameters  of  the  Fourth  Amendment 
Instead,  Carnivore  ensures  that  law  enforcement  only  gets  those  specific  e-mails  addressed  as 
described  in  the  court’s  order  to  the  complete  exclusion  of  everything  else  on  the  Internet. 

Sincerely  yours. 


John  E.  Coll  logwood 
Assistant  Director 
Office  of  Public  and 
Congressional  Affairs 
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KEVIN  V.  DI  GREGORY 
DEPUTY  ASSISTANT  ATTORNEY  GENERAL 
CRIMINAL  DIVISION 
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BEFORE  THE 

SUBCOMMITTEE  ON  THE  CONSTITUTION 
COMMITTEE  ON  THE  JUDICIARY 
UNITED  STATES  HOUSE  OF  REPRESENTATIVES 

CONCERNING 

"CARNIVORE"  AND  THE  FOURTH  AMENDMENT 

PRESENTED  ON 
JULY  24,  2000 
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STATEMENT  OF 
KEVIN  V.  Di  GREGORY 
DEPUTY  ASSISTANT  ATTORNEY  GENERAL 
UNITED  STATES  DEPARTMENT  OF  JUSTICE 
BEFORE  THE  SUBCOMMITTEE  ON  THE  CONSTITUTION 
OF  THE  HOUSE  COMMITTEE  ON  THE  JUDICIARY 

on 

“CARNI  VORE”  AND  THE  FOURTH  AMENDMENT 
July  24, 2000 

Mr.  Chairman  and  Members  of  the  Subcommittee,  thank  you  for  allowing  me  this 
opportunity  to  testily  about  the  law  enforcement  tool  “Carnivore”  and  the  Fourth  Amendment 
On  April  6, 2000, 1  had  the  privilege  of  testifying  before  you  during  a  hearing  on  Internet  privacy 
and  the  Fourth  Amendment;  I  am  pleased  to  continue  to  participate  in  the  discussion  today  about 
“Carnivore”  and  its  role  in  protecting  individual  privacy  on  the  Internet  from  unwarranted 
governmental  intrusion,  and  about  the  critical  role  the  Department  plays  to  ensure  that  the 
Internet  is  a  safe  and  secure  place. 

Privacy  and  Public  Safety 

It  Is  beyond  dispute  that  the  Fourth  Amendment  protects  the  rights  of  Americans  while 
they  work  and  play  on  the  Internet  just  as  it  does  in  the  physical  world.  The  goal  is  a  long- 
honored  and  noble  one:  to  preserve  our  privacy  while  protecting  the  safety  of  our  citizen  s.  Our 
founding  fathers  recognized  that  in  order  for  our  democratic  society  to  remain  safe  and  our 
liberty  intact,  law  enforcement  must  have  the  ability  to  investigate,  apprehend  and  prosecute 
people  for  criminal  conduct  At  the  same  time,  however,  our  founding  fathers  held  in  disdain  the 
government’s  disregard  and  abuse  of  privacy  in  England.  The  founders  of  this  nation  adopted  the 
Fourth  Amendment  to  address  the  tension  that  can  at  times  arise  between  privacy  and  public 
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safety*  Under  the  Fourth  Amendment,  the  government  must  demonstrate  probable  cause  before 
obtaining  a  warrant  for  a  search,  arrest,  or  other  significant  intrusion  on  privacy. 

Congress  and  the  courts  have  also  recognized  that  lesser  intrusions  on  privacy  should  be 
permitted  under  a  less  exacting  threshold.  The  Electronic  Communications  Privacy  Act 

(“EOF A”)  establishes  a  three-tier  system  by  which  the  government  can  obtain  stored  information 

( 

from  electronic  communication  service  providers.  In  general,  the  government  needs  a  search 
warrant  to  obtain  the  content  of  unretrieved  communications  (like  e-mail),  a  court  order  to  obtain 
transactional  records,  and  a  subpoena  to  obtain  information  identifying  the  subscriber.  See  l  8 
U.S.C.  §§2701-11. 

In  addition,  in  order  to  obtain  source  and  destination  information  in  real  time,  the 

government  must  obtain  a  “trap  and  trace”  or  “pen  register”  court  order  authorizing  the  recording 

of  such  information.  See  18  U.S.C.  3121,  et  seq. 

Because  of  the  privacy  values  it  protects,  the  wiretap  statute,  18  U.S.C.  §§  2510*22, 

♦ 

commonly  known  as  Title  Ilf,  places  a  higher  burden  on  the  real-time  Interception  of  oral,  wire 
and  electronic  communications  than  the  Fourth  Amendment  requires.  In  the  absence  of  a 
statutory  exception,  the  government  needs  a  court  order  to  wiretap  communications.  To  obtain 
such  an  order,  the  government  must  show  that  normal  investigative  techniques  for  obtaining  the 
information  have  or  are  likely  to  fail  or  are  too  dangerous,  and  that  any  interception  will  be 
conducted  so  as  to  ensure  that  the  intrusion  is  minimized. 

The  safeguards  for  privacy  represented  by  foe  Fourth  Amendment  and  statutory 
restrictions  on  government  access  to  information  do  not  prevent  effective  law  enforcement 
Instead,  they  provide  boundaries  for  law  enforcement,  clarifying  what  is  acceptable  evidence 
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gathering  and  what  is  not.  At  the  same  time,  those  who  care  deeply  about  protecting  individual 
privacy  must  also  acknowledge  that  law  enforcement  has  a  critical  role  to  play  in  preserving 
privacy.  When  law  enforcement  investigates,  successfully  apprehends  and  prosecutes  a  criminal 
who  has  stolen  a  citizen’s  personal  information  from  a  computer  system,  for  example,  law 
enforcement  is  undeniably  working  to  protect  privacy  and  deter  further  privacy  violations.  The 
same  is  true  when  law  enforcement  apprehends  a  hacker  who  compromised  the  financial  records 
of  a  bank  customer. 

As  we  move  into  the  2 1 8  century,  we  must  ensure  that  the  needs  of  privacy  and  public 
safety  remain  in  balance  and  are  appropriately  reflected  in  the  new  and  emerging  technologies 
that  are  changing  the  face  of  communications.  Although  the  primary  mission  of  the  Department 
of  Justice  is  law  enforcement,  Attorney  General  Reno  and  the  entire  Department  understand  and 
share  the  legitimate  concerns  of  all  Americans  with  regard  to  personal  privacy.  The  Department 
has  been  and  will  remain  committed  to  protecting  the  privacy  rights  of  individuals.  We  look 
forward  to  working  with  Congress  and  other  concerned  individuals  to  address  these  important 
matters  in  the  months  ahead. 

Law  Enforcement  Tools  in  Cyberspace: 

Although  the  Fourth  Amendment  is  over  two  centuries  old,  fee  Internet  as  we  know  it  is 
still  in  its  infancy.  The  huge  advances  in  the  past  ten  years  have  changed  forever  the  landscape 
of  society,  not  just  in  America,  but  worldwide.  The  Internet  has  resulted  in  new  and  exciting 
ways  for  people  to  communicate,  transfer  information,  engage  in  commerce,  and  expand  their 
educational  opportunities.  These  are  but  a  few  of  the  wonderful  benefits  offers  rapidly  changing 
technology.  As  has  been  the  case  with  every  major  technological  advance  in  our  history, 
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however,  we  are  seeing  individuals  and  groups  use  this  technology  to  commit  criminal  acts.  As 
Deputy  Attorney  General  Eric  Holder  told  the  Crime  Subcommittee  of  this  Committee  in 
February,  our  vulnerability  to  computer  crime  is  astonishingly  high  and  threatens  not  only  cur 
financial  well-being  and  oar  privacy,  but  also  this  nation’s  critical  infrastructure. 

Many  of  the  crimes  that  we  confront  everyday  in  the  physical  world  are  beginning  to 

appear  in  the  online  world.  Crimes  like  threats,  extortion,  fraud,  identity  theft,  and  child 

pornography  are  migrating  to  the  Internet,  the  Fourth  Amendment  and  laws  addressing  pri  vacy 

and  public  safety  serve  as  a  framework  for  law  enforcement  to  respond  to  this  new  forum  for 

criminal  activity.  If  law  enforcement  fails  properly  to  respect  individual  privacy  in  its 

investigative  techniques,  the  public’s  confidence  in  government  will  be  eroded,  evidence  will  be 

suppressed,  and  criminals  will  elude  successful  prosecution.  If  law  enforcement  Is  too  timid  in 

responding  to  cybercrime,  however,  we  will,  in  effect,  render  cyberspace  a  safe  haven  for 

criminals  and  terrorists  to  communicate  and  cany  out  crime,  without  fear  of  authorized 

* 

government  surveillance.  If  we  fail  to  make  the  Internet  safe,  people’s  confidence  in  using  the 
Internet  and  e-commerce  will  decline,  endangering  the  very  benefits  brought  by  the  Information 
Age.  Proper  balance  is  the  key, 

To  satisfy  our  obligations  to  the  public  to  enforce  the  laws  and  preserve  the  safety',  we  use 
the  same  sorts  of  investigative  techniques  and  methods  online  as  we  do  in  the  physical  world, 
with  the  same  careful  attention  to  the  strict  constitutional,  statutory,  internal  and  court-ordered 
boundaries.  Carnivore  is  simply  an  investigative  tool  that  is  used  online  only  under  narrowly 
defined  circumstances,  and  only  when  authorized  by  law,  to  meet  our  responsibilities  to  the 
public. 
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To  illustrate,  iavv  enforcement  often  needs  to  find  out  from  whom  a  drug  dealer,  for 
instance,  is  buying  his  illegal  products,  or  to  whom  the  drug  dealer  is  selling.  To  investigate  this, 
it  is  helpful  to  determine  who  is  communicating  with  the  drug  dealer.  In  the  “olden  days”  of 
perhaps  10  years  ago,  the  drag  dealer  would  have  communicated  with  his  supplier  and  customers 
exclusively  through  use  of  telephones  and  pagers.  Law  enforcement  would  obtain  an  order  from 
a  court  authori  zing  the  installation  of  a  “trap  and  trace”  and  a  “pen  register”  device  on  die  drag 
dealer’s  phone  or  pager,  and  either  the  telephone  company  or  law  enforcement  would  have 
installed  these  devices  to  comply  with  the  court’s  order.  Thereafter,  the  source  and  destination  of 
his  phone  calls  would  have  been  recorded.  This  is  information  that  courts  have  held  is  not 
protected  by  any  reasonable  expectation  of  privacy.  Given  the  personal  nature  of  this 
information,  however,  the  law  requires  government  to  obtain  an  order  under  these  circumstances. 
In  this  way,  privacy  is  protected  and  law  enforcement  is  able  to  investigate  to  protect  the  public. 

Now,  that  same  drug  dealer  may  be  just  as  likely  to  send  an  e-mail  as  call  his 

* 

confederates.  When  law  enforcement  uses  a  “trap  and  trace”  or  “pen  register”  in  the  online 
context,  however,  we  have  found  that,  at  times,  the  Internet  service  provider  has  been  unable  or 
even  unwilling  to  supply  this  information.  Law  enforcement  cannot  abdicate  its  responsibility  to 
protect  public  safely'  simply  because  technology  has  changed.  Rather,  the  public  rightfully 
expects  that  law  enforcement  will  continue  to  be  effective  as  criminal  activity  migrates  to  the 
Internet  We  cannot  do  this  without  tools  like  Carnivore. 

When  a  criminal  uses  e-mail  to  send  a  kidnaping  demand,  to  buy  and  sell  illegal  drugs  or 
to  distribute  child  pornography,  law  enforcement  needs  to  know  to  whom  he  is  sending  messages 
and  from  whom  he  receives  them.  To  get  this  information,  we  obtain  a  court  order,  which  we 
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serve  on  the  appropriate  service  provider.  Because  of  the  nature  ofintemet  communications,  the 
addressing  information  (which  does  not  include  the  content  of  the  message)  is  often  mixed  in 
with  a  lot  of  other  non-content  data  that  we  have  no  desire  to  gather.  If  the  service  provider  can 
comply  with  the  order  and  provide  us  with  only  the  addressing  informatkm  required  by  court 
order,  it  will  do  so  and  we  will  not  employ  Carnivore:  If,  however,  the  service  provider  is 
unwilling  or  unable  to  comply  with  the  order,  we  simply  cannot  give  a  criminal  a  free  pass.  It  is 
for  that  narro  w  set  of  circumstances  that  the  FBI  designed  “Carnivore.” 

Carnivore  is,  in  essence,  a  special  filtering  tool  that  can  gather  the  information  authorized 
by  court  order,  and  only  that  information.  It  permits  law  enforcement,  for  example,  to  gather 
only  the  email  addresses  of  those  persons  with  whom  the  drug  dealer  is  communicating,  without 
allowing  any  human  being,  either  from  law  enforcement  or  the  service  provider,  to  view  private 
information  outside  of  the  scope  of  the  court’s  order.  In  other  words,  Carnivore  is  a  minimization 
tool  that  permits  lav*'  enforcement  strictly  to  comply  with  court  orders,  strongly  to  protect 
privacy,  and  effectively  to  enforce  the  law  to  protect  the  public  interest.  In  addition,  Carnivore 
creates  an  audit  trail  that  demonstrates  exactly  what  it  is  capturing. 

As  with  any  other  investigative  tools,  there  are  many  mechanisms  we  have  in  place  to 
prevent  against  possible  misuse  of  Carnivore,  and  to  remedy  misuse  that  has  occurred.  The 
Fourth  Amendment,  of  course,  restricts  what  law  enforcement  can  do  with  Carnivore,  as  do  the 
statutory  requirements  of  Title  lU  and  the  Electronic  Communications  Privacy  Act,  and  the 
courts. 

For  federal  Title  III  applications,  the  Department  of  Justice  imposes  its  own  guidelines  on 
top  of  the  privacy  protections  provided  by  the  Constitution,  statutes  and  the  courts  .  For  example, 
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before  Carnivore  may  be  used  to  intercept  wire  or  electronic  communications,  the  requesting 
investigative  agency  must  obtain  approval  for  the  Title  III  application  from  the  Department  of 
Justice.  Specifically,  the  Office  of  Enforcement  Operations  (OEO)  in  the  Criminal  Division  of 
the  Department  reviews  each  proposed  Title  III  application  to  ensure  that  the  interception 
satisfies  the  Fourth  Amendment  requirements,  and  is  in  compliance  with  applicable  statutes  and 
regulations.  Even  if  the  proposal  clears  the  OEO,  approval  must  be  given  by  a  Deputy  Assistant 
Attorney  General.  Although  this  requirement  of  high-level  review  is  required  by  Title  HI  only 
with  regard  to  proposed  intercepts  of  wire  and  oral  communications,  the  Department  voluntarily 
imposes  the  same  le  vel  of  re  view  for  proposed  interceptions  of  electronic  communications 
(except  digital-display  pagers).  Typically,  investigative  agencies  such  as  the  Federal  Bureau  of 
Investigation  have  similar  internal  requirements,  separate  and  apart  from  Constitutional,  statutory 
or  Department  of  Justice-  requirements. 

If  the  investigative  agency  and  the  Department  of  Justice  approve  a  federal  Title  III 
request,  it  still  must,  of  course,  be  approved  by  the  proper  court  .  The  court  will  evaluate  the 
application  under  the  Fourth  Amendment  and  using  the  familiar  standards  of  Title  HI.  By  statute, 
for  example,  the  application  to  the  court  must  show,  through  sworn  affidavit,  why  the  intercept  is 
necessary  as  opposed  to  other  less-intrusive  investigative  techniques.  The  application  must  also 
provide  additional  detail,  including  whether  there  have  been  previous  interceptions  of 
communications  of  the  target,  the  identity  of  the  target  (if  kno  wn),  the  nature  and  l  ocation  of  the 
communications  facilities,  and  a  descriptio  n  of  the  type  of  communications  sought  and  the 
offenses  to  which  the  communications  relate.  By  statute  and  internal  Department  regulation,  the 
interception  may  last  no  longer  than  39  days  without  an  extension  by  the  court. 
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Courts  also  often  impose  their  own  requirements.  For  example,  many  federal  courts 
require  that  the  investigators  provide  periodic  reports  setting  Forth  information  such  as  the 
number  of  communications  intercepted,  steps  taken  to  minimize  irrelevant  traffic,  and  whether 
the  interceptions  have  been  fruitful.  The  court  may,  of  course  terminate  the  interception  at  any 
time. 

{ 

The  remedies  for  violating  Title  HI  or  ECPA  by  improperly  intercepting  electronic 
communications  can  include  criminal  sanctions,  civil  suit,  and  for  law  enforcement  agents, 
adverse  employment  action.  For  violations  of  the  Fourth  Amendment,  of  course,  the  remedy  of 
suppression  is  also  available. 

Carnivore  itself  also  contains  self  regulating  features.  For  example,  because  of  its 
sophisticated  passive  filtering  features,  it  automates  the  process  of  minimization  without 
intrusive  monitoring  by  investigators,  and  simply  disregards  packets  of  information  that  do  not 
satisfy  the  criteria  in  the  court’s  authorization.  Indeed,  one  of  the  most  powerful  privacy* 
protecting  features  of  Carnivore  is  its  ability  to  ignore  information  that  is  outside  the  scope  of  the 
court-ordered  authority.  For  later  verification,  it  also  logs  the  filter  settings.  In  addition,  as  a 
practical  matter.  Carnivore  is  not  deployed  except  with  close  cooperation  with  the  appropriate 
system  provider.  la  any  event,  the.FHI  does  not  use  Carnivore  in  every  instance  in  which  the 
court  orders  a  Title  IB  electronic  communication  intercept  Indeed,  I  understand  that  the  Bureau 
uses  Carnivore  only  in  those  instances  when  the  service  provider  is  unable  to  comply  with  the 
court  order  using  its  own  equipment,  or  when  the  provider  asks  the  FBI  to  use  Bureau  equipment. 

As  I  testified  in  April,  we  face  three  major  categories  of  challenges  in  trying  to  keep  the 
Internet  a  safe  and  secure  place  for  our  citizens.  These  are: 
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1 .  Technical  challenges  that  hamper  law  enforcement's  ability  to  locate  and 
prosecute  criminals  that  operate  online; 

2.  Certain  substantive  and  procedural  laws  that  have  not  kept  pace  with  the  changing 
technology,  creating  significant  legal  challenges  to  effective  investigation  and 
prosecution  of  crime  in  cyberspace;  and 

3 .  Resource  needs  that  must  be  addressed  to  ensure  that  law  enforcement  can  keep 
pace  with  changing  technology  and  has  the  ability  to  hire  and  train  people  to  fight 
cybercrime. 

Carnivore  is  an  investigative  tool  that  assists  us  in  meeting  the  first  challenge.  As  we 
have  witnessed,  tracking  a  criminal  online  is  not  always  an  impossible  task  using  our 
investigative  tools.  For  example,  last  year  federal  and  state  law  enforcement  combined  to 
successfully  apprehend  the  creator  of  the  Melissa  virus  and  the  individual  who  created  a 
fraudulent  Bloomberg  News  Service  website  in  order  to  artificially  drive  up  the  stock  price  of 
PairGain,  a  telecommunications  company  based  in  California.  Although  we  are  proud  of  these 
important  successes,  we  still  face  significant  challenges  as  online  criminals  become  more  and 
more  sophisticated. 

In  nearly  every  online  case,  tracking  the 'on  line  criminal  requires  law  enforcement  to 
attempt  to  trace  the  “electronic  trail”  from  the  victim  back  to  the  perpetrator.  In  effect,  this 
“electronic  trail”  is  the  fingerprint  of  the  twenty-first  century  -  only  much  harder  to  find  and  not 
as  permanent  as  its  more  traditional  predecessor.  In  the  physical  world,  a  criminal  and  his  victim 
are  generally  in  the  same  location.  But  cybercriminals  do  not  have  to  physically  visit  the  crime 
scene.  Instead  they  cloak  their  illegal  activity  by  weaving  communications  through  a  series  of 
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anonymous  remailers,  by  creating  forged  e-mail  headers  with  powerful  point  and  click  tools 
readily  downloadable  from  hacker  websites,  by  using  a  '‘free-trial"  account  or  two,  or  by  “wiping 
dean"  the  logging  records  that  would  be  evidence  of  their  activity. 

In  some  cases,  the  criminal  may  not  even  be  in  the  same  country  as  the  victim.  The  global 
nature  of  the  internet,  white  one  of  the  greatest  assets  of  the  Internet  to  law-abiding  citizens, 
allows  criminals  to  conduct  their  illegal  activity  from  across  the  globe.  In  these  cases,  the  need 
to  respond  quickly  and  track  the  criminal  is  increasingly  complicated  and  often  frustrated  by  the 
fact  that  the  activity  takes  place  throughout  different  countries.  With  more  than  190  countries 
connected  to  the  Internet,  it  is  easy  to  understand  the  coordination  challenges  that  face  law 
enforcement.  Furthermore,  in  these  cases,  time  is  of  the  essence  and  the  victim  may  not  even 
realize  they  have  been  victimized  until  the  criminal  has  long  since  signed-off.  Clearly,  the 
technical  challenges  for  law  enforcement  are  real  and  profound. 

This  fact  was  made  dear  in  the  findings  and  conclusions  reached  in  the  recently  released 
report  of  the  President’s  Working  Group  on  Unlawful  Conduct  on  the  Internet,  entitled,  “The 
Electronic  Frontier:  The  Challenge  of  Unlawful  Conduct  Involving  the  Use  of  the  Internet.”  This 
extensive  report  highlights  in  detail  the  significant  challenges  facing  law  enforcement  in 
cyberspace.  As  the  report  states,  the  needs  and  challenges  confronting  law  enforcement,  “are 
neither  trivial  nor  theoretical.”  The  Report  outlines  a  three-pronged  approach  for  responding  to 
unlawful  activity  on  the  Internet: 

1 ,  Conduct  on  the  Internet  should  be  treated  in  the  same  manner  as  simitar  conduct 
offline,  in  a  technology  neutral  manner. 
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2,  We  must  recognize  that  the  needs  and  challenges  of  law  enforcement  posed  by  the 
Internet  are  substantial,  including  our  need  for  resources,  up-to  date  investigative 
tools  and  enhanced  multi-jurisdictional  cooperation. 

3.  Finally,  we  need  to  foster  continued  support  for  private  sector  leadership  in 
developing  tools  and  methods  to  help  Internet  users  to  prevent  and  minimize  the 
risks  of  unlawful  conduct  online. 

I  would  encourage  anyone  with  an  interest  in  tins  important  topic  to  review  carefully  the 
report  of  the  Working  Group.  The  report  can  be  found  on  the  Internet  by  visiting  the  website  of 
the  Department  of  Justice’s  Computer  Crime  and  Intellectual  Property  Section,  located  at 
www.evbemrime.gov.  In  addition  to  the  report,  ww.eybercrime.gov  also  contains  other  useful 
information  on  a  wide  array  of  Internet  related  issues,  including  the  topic  of  today’s  hearing  - 
privacy. 

Despite  the  type  of  difficulties  outlined  in  the  Unlawful  Conduct  Report  and  discussed 

♦ 

today,  the  Justice  Department  and  law  enforcement  across  this  nation  are  committed  to 
continuing  to  work  together  and  with  their  counterparts  in  other  countries  to  develop  and 
implement  investigative  strategies  to  successfully  track,  apprehend,  and  prosecute  individuals 
who  conduct  criminal  activity  on  the  Internet,  In  so  doing,  the  same  privacy  standards  that  apply 
in  the  physical  world  remain  effective  online. 

Mr.  Chairman,  the  Department  of  Justice  has  taken  a  proactive  leadership  role  in  making 
cyberspace  safer  for  all  Americans.  The  cornerstone  of  our  cybercrime  prosecutor  program  is  the 
Criminal  Division’s  Computer  Crime  and  Intellectual  Property  Section,  known  as  COPS. 

COPS  was  founded  in  1991  as  the  Computer  Crime  Unit,  and  became  a  Section  in  1996.  COPS 
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has  grown  from  five  attorneys  in  1996  to  nineteen  today,  and  we  need  more  to  keep  pace  with  the 


014 


demand  for  their  expertise.  The  attorneys  in  GCIPS  work  closely  on  computer  crime  cases  with 
Assistant  United  States  Attorneys  known  as  “Computer  and  Telecommunications  Coordinators,” 
or  CTC’s,  in  U.S.  Attorney’s  Offices  around  the  nation.  Each  CTC  receives  special  training  and 
equipment  and  serves  as  the  district’s  expert  on  computer  crime  cases.  CCIPS  and  the  CTC’s 
work  together  in  prosecuting  cases,  spearheading  training  for  local,  state  and  federal  law 
enforcement,  working  with  international  counterparts  to  address  difficult  international 
challenges,  and  providing  legal  and  technical  instruction  to  assist  in  the  protection  of  this 
nation’s  critical  infrastructures.  We  are  very  proud  of  the  work  these  people  do  and  we  will 
continue  to  work  diligently  to  help  stop  criminals  from  victimizing  people  online. 

I  also  note  that  public  education  is  an  important  component  of  the  Attorney  General’s 
strategy  on  combating  computer  crime.  As  she  often  notes,  the  same  children  who  recognize  that 
it  is  wrong  to  steal  a  neighbor’s  mail  or  shoplift  do  not  seem  to  understand  that  it  is  equally 

K 

wrong  to  steal  a  neighbor’s  e-mail  or  copy  a  proprietary  software  or  music  file  without  paying  for 
it.  To  remedy  this  problem,  the  Department  of  Justice,  together  with  the  Information  Technology 
Association  of  America  (ITAA)  ,  has  embarked  upon  a  national  campaign  to  educate  and  raise 
awareness  of  computer  responsibility  and  to  provide  resources  to  empower  concerned  citizens. 

.*  4  4* 

The  "Cybercitizen  Awareness  Program”  seeks  to  engage  children,  young  adults,  and  others  on 


the  basics  of  critical  information  protection  and  security  and  on  the  limits  of  acceptable  online 
behavior.  The  objectives  of  the  program  are  to  give  children  an  understanding  of  cyberspace 
benefits  and  responsibilities,  an  awareness  of  consequences  resulting  from  the  misuse  of  the 
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medium  and  an  understanding  of  the  persona!  dangers  that  exist  on  the  Internet  and  techniques  to 
avoid  being  harmed. 

Finally,  Mr.  Chairman,  the  Subcommittee  may  be  aware  that  the  Administration  will  soon 
be  transmitting  to  Congress  a  legislative  proposal  addressing  various  issues  relating  toxyber- 
security.  I  know  that  fee  focus  of  today's  hearing  is  the  Carnivore  program,  and  this  is  not  the 
time  to  undertake  any  detailed  discussion  of  the  Administration's  proposal.  I  would,  however, 
like  to  mention  two  points  that  relate  directly  to  today's  discussion.  First,  fee  Administration 
supports  raising  the  statutory  standards  for  intercepting  the  content  of  electronic  communications 
so  they  are  fee  same  as  those  for  intercepting  telephone  calls:  high-level  approval,  use  only  in 
cases  involving  certain  predicate  offenses  feat  are  specified  by  statute,  and  statutory  suppression 
of  evidence  derived  from  improper  intercepts,  Second,  the  Administration  supports  requiring 
federal  judges  to  confirm  that  the  appropriate  statutory  predicates  have  been  satisfied  before 
issuing  a  pen  register  or  trap-and-trace  order.  Those  changes  would  apply  to  the  use  of  Carnivore 
~  and  would,  in  important  respects,  simply  confirm  by  statute  fee  policies  and  procedures  already 
followed  by  the  Department  of  Justice.  Beyond  those  specific  points,  I  will  simply  note  here  that 
fee  Administration  supports  a  balanced  updating  of  laws  to  enhance  protection  of  both  privacy 
and  public  safety,  and  that  the  forthcoming  proposal  will  contain  important  provisions  whose 
enactment  would  be  most  helpful  in  the  ongoing  fight  against  cyber-crime. 

Mr.  Chairman,  I  want  to  thank  you  again  for  this  opportunity  to  testify  today  about  our  . 
efforts  to  fight  crime  on  the  Interact  while  preserving  the  rights  conferred  by  the  Fourth 
Amendment  and  statute.  Ultimately,  the  decision  as  to  the  appropriate  parameters  of  law 
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enforcement  activity  lies  squarely  within  the  Constitution  and  the  elected  representatives  of  the 
people,  the  Congress.  The  need  to  protect  the  privacy  of  the  American  people,  not  just  from  the 
government  hut  also  from  criminals,  is  a  paramount  consideration,  not  just  in  the  context  of  the 
Internet,  but  in  general.  The  Department  of  Justice  stands  ready  to  work  with  this  Subcommittee 
and  others  to  achieve  the  proper  balance  between  the  important  need  for  protecting  privacy  and 
the  need  to  respond  to  the  growing  threat  of  crime  in  cyberspace. 

Mr.  Chairman,  that  concludes  my  prepared  statement.  I  would  be  pleased  to  attempt  to 
answer  any  questions  that  you  may  have  at  this  time. 
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Oral  Statement  of  Kevin  Bi  Gregory 

Mr.  Chairman,  and  Members  of  the  Subcommittee,  thank  you  for  allowing  me  this 
opportunity  to  testify  about  the  law  enforcement  tool  “Carnivore”  and  the  Fourth  Amendment. 

We  have  seen  magnificent  growth  of  the  internet  over  the  iast  ten  years.  It  has  created 

vast  benefits  for  citizens,  businesses  and  governments,  and  seems  to  hold  boundless  promise  If  we 

( 

can  harness  it.  The  Internet  has  spurred  a  new  and  thriving  economy.  Many  businesses  have 

prospered  by  providing  their  products  and  services  through  the  Internet.  Others  have  assisted  in 

building,  maintaining  and  improving  the  Internet  itself.  The  Internet  has  given  people  jobs, 

supported  families  and  communities  and  created  new  opportunities  for  commerce  for  America  and 

the  world.  The  Internet  has  touched  both  our  working  lives  and  our  family  lives. . . . . 

As  we  have  seen  throughout  history,  however,  there  are  those  who  use  the  powerful  tools 

of  progress  to  inflict  harm  on  others.  The  Internet  has  not  escaped  this  historical  truth.  Even  in 

the  internet’s  relatively  short  existence  we  have  seen  a  wide  range  of  criminal  use  of  the 

* 

technology.  It  has  been  used  to  commit  traditional  crimes  against  an  ever  widening  number  of 
victims.  There  are  aiso  those  criminals  intent  on  attacking  and  disrupting  computers,  computer 
networks  and  the  Internet  itself.  In  short,  although  the  Internet  provides  an  unparalleled 
opportunities  for  Americans  to  freely  express  ideas,  it  also  provides  a  very  effective  means  for 
ill-motivated  persons  to  breach  the  privacy  and  security  of  others. 

Many  of  the  crimes  that  we  confront  everyday  in  the  physical  world  are  beginning  to 
appear  in  the  online  world.  Crimes  like  threats,  extortion,  fraud,  identity  theft,  and  child 
pornography  are  migrating  to  the  Internet.  The  Fourth  Amendment  and  laws  addressing  privacy 
and  public  safety  serve  as  a  framework  for  law  enforcement  to  respond  to  this  new  forum  for 
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criminal  activity  .  If  law  enforcement  fails  properly  to  respect  individual  privacy  in  its  investigative 
techniques,  the  public's  confidence  in  government  will  be  eroded,  evidence  will  be  suppressed, 
and  criminals  will  dude  successful  prosecution.  If  law  enforcement  is  too  timid  in  responding  to 
cybercrime,  however,  we  will,  in  effect,  render  cyberspace  a  safe  haven  for  criminals  and  terrorists 
to  communicate  and  carry  out  crime,  without  fear  of  authorized  government  surveillance.  If  we 
fall  to  make  the  Internet  safe,  people’s  confidence  in  using  the  Internet  and  e-eommerce  will 
decline,  endangering  the  very  benefits  brought  by  the  Information  Age.  Proper  balance  is  the  key. 

Despite  the  fervor  over  the  unfortunately-named  “Carnivore,”  the  truth  of  the  matter  is 
that  Carnivore  is  in  reality  a  tool  that  helps  us  achieve  this  balance.  To  satisfy  our  obligations  to 
the  public  to  enforce  the  laws  and  preserve  public  safety,  we  use  the  same  sorts  of  investigatory 
techniques  and  methods  online  as  we  do  in  the  physical  world,  with  the  same  careful  attention  to 
the  strict  constitutional  and  legal  limits.  Carnivore  is  simply  an  investigatory  tool  that  helps  us  to 
investigate  online  in  the  same  way  as  in  the  physical  world,  and  enables  us  to  obtain  only  the 
information  we  are  authorized  to  obtain  through  a  court  order. 

To  illustrate,  law  enforcement  often  needs  to  find  out  from  whom  a  drug  dealer,  for 
instance,  is  buying  bis  illegal  products,  or  to  whom  the  drug  dealer  is  selling  his  goods.  It  is 
therefore  important  to  determine  with  whom  the  drug  dealer  is  communicating.  In  the  “olden 
days”  of  perhaps  10  years  ago,  the  drug  dealer  would  have  communicated  with  his  supplier  and 
customers  exclusively  through  use  of  telephones  and  pagers.  Law  enforcement  would  obtain  an 
order  from  a  court  authorizing  the  installation  of  a  “trap  and  trace”  and  a  “pen  register”  device  on 
the  drug  dealer’s  phone  or  pager.  Now,  that  same  drug  dealer,  or  a  kidnapper  or  a  child 

2 


5/24/02  Release  -  Pa| 


'Vvtf. 


porno  grapher,  may  be  just  as  likely  to  send  an  e-mail  as  to  call  his  confederates  . 

When  law  enforcement  uses  a  “trap  and  trace”  or  “pen  register”  in  the  online  context, 
however,  we  have  found  that,  at  times,  the  Internet  service  provider  has  been  unable  or  even 
unwilling  to  supply  this  information.  It  is  for  that  narrow  set  of  circumstances  that  the  FBI 
designed  “Carnivore.”  Law  enforcement  cannot  abdicate  its  responsibility  to  protect  public  safety 
simply  because  technology  has  changed.  Rather,  the  public  rightfully  expects  that  law 
enforcement  will  continue  to  be  effective  as  criminal  activity  migrates  to  the  Internet  We  cannot 
do  this  without  tools  like  Carnivore. 

Carnivore  is,  in  essence,  a  special  filtering  tool  that  can  gather  the  information  authorized 
by  court  order,  and  only  that  information.  It  permits  law  enforcement,  for  example,  to  gather 
pursuant  to  an  order  only  the  email  addresses  of  those  persons  with  whom  the  drug  dealer  is 
communicating,  without  allowing  any  human  being,  either  from  law  enforcement  or  the  service 
provider,  to  view  private  information  outside  of  the  scope  of  the  court’s  order.  In  other  W'ords, 
Carnivore  is  a  minimization  tool  that  permits  law  enforcement  to  comply  with  court  orders,  to 
protect  privacy,  and  to  enforce  the  law  to  protect  the  public  interest,  In  addition,  Carnivore 
creates  an  audit  trail  that  demonstrates  exactly  what  it  is  capturing. 

And  as  with  any  other  investigative  tools,  there  are  many  mechanisms  we  have  in  place  to 
prevent  possible  misuse  of  Carnivore,  and  to  remedy  misuse  that  has  o  ccurred.  The  Fourth 
Amendment  and  the  courts,  of  course,  restricts  what  law  enforcement  can  do  on  line,  with  or 
without  Carnivore,  as  do  the  statutory  requirements  of  Title  III  and  the  Electronic 
Communications  Privacy  Act 

In  the  case  of  federal  Title  III  applications,  foe  Department  of  Justice  imposes  its  own 
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guidelines  on  top  of  the  privacy  protections  provided  by  the  Constitution,  statutes  and  the  courts. 
For  example,  before  Carnivore  may  be  used  to  intercept  wire  or  electronic  communications,  with 
the  limited  exception  of  digital  display  pagers,  the  requesting  investigatory  agency  must  obtain 
approval  for  the  Title  HI  application  from  the  Department  of  Justice.  Specifically,  the  Office  of 
Enforcement  Operations  in  the  Criminal  Division  of  the  Department  reviews  each  proposed  Title 
HI  application  to  ensure  that  foe  interception  satisfies  foe  Fourth  Amendment  requirements,  and  is 
in  compliance  with  applicable  statutes  and  regulations.  If  the  proposal  clears  foe  OEO,  appro  val 
must  generally  be  given  by  a  Deputy  Assistant  Attorney  GeneisL  Typically,  investigative  agencies 
such  as  the  Federal  Bureau  of  Investigation  have  similar  but  separate  internal  requirements. 

If  the  investigative  agency  and  the  Department  of  Justice  approve  a  federal  Title  HI 
request,  it  still  must,  of  course,  be  approved  by  the  proper  court  using  familiar  but  exacting 
standards.  By  statute  and  internal  Department  regulation,  foe  interception  may  last  no  longer 
than  30  days  without  an  extension  by  foe  court.  And  courts  also  often  impose  their  own 
additional  requirements. 

In  addition,  the  remedies  for  violating  Title  IH  or  ECPA  by  improperly  intercepting 
electronic  communications  include  criminal  sanctions  and  civil  suits.  For  violations  of  foe  Fourth 
Amendment,  of  course,  the  remedy  of  suppression  is  also  available. 

Despite  this  panoply  of  protections,  we  recognise  that  concerns  remain  about  this  tool. 
Therefore,  the  Attorney  General  has  asked  for  an  independent  review  of  foe  Carnivore  source 
code  to  ensure  that  its  capabilities  are  what  we  understand  them  to  be.  A  report  generated  from 
foe  review  will  be  publicly  disseminated  to  interested  groups  within  industry,  academia  and 
elsewhere,  and  should  alleviate  any  concerns  regarding  unjustified  intrusions  on  privacy  from  foe 
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Committee  with  my  full  written  statement  It  is  my  sincere  hope  and  expectation  that  through  this 

Softer  to,  there  of«who  are  concerned  about  ?riveey»d  public  ^wtllreeogmee  to 

responsible  law  enforcement  can  enhance  both  goals. 
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Miiimm  of  Americans  now  tog  on  to  the  inter- 
net  as  naturally  and  as  frequently  as  they  pick  up  a 
phone.  Technology  has  created  a  revolution  in  per¬ 
sonal  communications,  but  technology  is  also  mak¬ 
ing  it  possible  lor  government  and  even  employers 
to  monitor  private  conversations  as  never  before 
Telephones  laws  must  be  updated  to  address 
those  new  challenges  to  privacy. 

;  Last  week  the  White  House  proposed  some 
limited  changes  to  the  federal  wiretap  and  electron¬ 
ic  privacy  laws  that  would  raise  legal  standards  for 
government  interception  of  e-mail.  Separately,  sev¬ 
eral  lawmakers  Introduced  legislation  to  require 
employers  to  notify  employees  about  how  e-mail, 
Internet  use  and  phone  calls  are  monitored  Em¬ 
ployees  of  The  New  York  Times  Company  are 
already  notified  that  the  company  reserves  the 
right  to  review  e-mail  messages  while  investigating 
a  complaint.  Last  year  the  company  dismissed  23 
employees  -  most  based  at  a  regional  business 
office  —  for  sending  offensive  e-mail  messages. 

■  in  the  absence  of  more  stringent  controls,  law 
enforcement  agencies  may  be  tempted  to  conduct 
wholesale  monitoring  of  digital  written  communica¬ 
tions.  It  is  probably  not  practical  for  agents  to  listen 
m  on  all  the  phone  calls,  for  example,  that  to 
through  AT&T.  But  new  technology  is  making  it 
possible  for  agencies  like  the  F.BJ.  to  scan,  read 
and  record  millions  of  pieces  of  e-mail  on  the 
network  of  an  Internet  service  provider.  Until  now, 
this  kind  of  power  and  its  potential  for  abuse  were 
not  so  readily  available. 

Current  wiretapping  laws  were  not  drafted 
with  this  technology  in  mind  and  need  to  be  updated. 

V  ariaus  statutes  now  set  different  legal  standards 
for  the  secret  interception  of  domestic  communica- 
ttons  by  law  enforcement  agencies,  depending  on 
whether  the  communication  is  by  telephone,  e-mail 
or  cable  modem. 

The  Clinton  administration  is  proposing  to 


eliminate  these  inconsistencies.  Its  plan  would  bring 
the  standards  used  for  intercepting  e*maii  mes¬ 
sages  up  to  the  stricter,  more  protective  ievei  now 
applied  to  telephone  wiretaps.  Illegal  interception  of 
e*maii  would  result  in  suppression  of  the  evidence 
as  ts  the  case  now  with  illegal  interception  or  phone 
caiis.  The  proposal  would' also  enforce  the  same 
legal  standards  that  apply  to  phone  calls  for  inter¬ 
ception  of  e-mails  sent  by  cable  modems,  which 
have  a  greater  degree  of  privacy  protection  under  a 
law  that  governs  cable  systems. 

The  administration  is  also  calling  for  greater 
authority  for  courts  to  review  law  enforcement 
requests  to  use  devices  that  record  the  phone  num¬ 
bers  of  incoming  and  outgoing  calls  and  to  track  the 
origins  and  destinations  of  e-mail  messages. 

These  changes  are  clearly  needed.  But  Con¬ 
gress  also  needs  to  provide  new  safeguards  against 
the  government's  wrongful  use  of  ever  more  power¬ 
ful  surveillance  technology  against  law-abiding  citi- 
zms*  Serious  concerns  have  been  raised  about  Car- 
iitvort\  the  new  online  wiretap  system  used  by  the 
F.BX  to  track  the  communications  of  individuals 
suspected  of  criminal  activity. 

^  says  the  technology  can  isolate  the  e- 
tnail  of  the  target  of  an  investigation.  But  the 
system,  when  hooked  up  to  the  network  of  the 
internet  service  provider,  gives  die  3P\B,i  unlimited 
access  to  the  e-mail  of  all  other  subscribers  on  the 
network.  While  a  court  order  is  still  required  to 
intercept  ihe  content  of  messages,  the  secret  tech- 
nolQgy  controlled  exclusively  by  law  enforcement 
raises  fears  of  Improper  monitoring. 

Until  now,  routine  government  surveillance  of 
private  conversations  was  limited  as  much  by  prac- 
ticahty  as  by  legal  constraints.  Now  that  it  is 
f  easible  to  eavesdrop  electronically  on  an  unlimited 
scale,  the  laws  have  to  be  strengthened  to  prevent 
monitoring  of  all  online  communications  simply 
because  technology  makes  it  easy* 
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"The  warning  from  Colombia’s  Serrano 

Since.the  United  States  approved  £1.3  billion  What  the  ELN  did  war 

**^S*£“ 


What  the  ELN  did  want  to  discuss  is  the  1300 
square-mile  territory  that  Colombian  President 
^^Pastraraha^tentebv’eiy  agreed  to snrren- 

fo  implement  since  the  area,  which  is  rich  in  o3 


continued  unabated.  m  U>lomtJia 

Since  January’,  when  aid  to  Colombia  was 
approve^  the  Revolutionary  Armed  jFbrees  of 
CMomb^(B^O(aguerrilfe  group,  has  attacked 

aimost 200 pohce  stations  and  killed  more  than  100 


resioentsare  stmngWmpased 
to  forfeiting  the  region  to  the  ELN,  since  they  fear 
Irang  outside  of  the  government^  protection.  The 
government  save  the  PARC 


- « vxaj  r^ugas  mountain; 

ppears  to  have  resulted  in  the  deaths  of  60  mem 

hers  fifth  a  r  * _ ^ 


T  jj’  •  ™ ~  *  y<lx  Oil uiiuii  y  ngnififs 

In  addition,  on  Monday  200  FARC  terrorists 
ambushed  a  police  station  in  the  remote  south¬ 
western  province  of  Narrno,  which  is  rich  in  opium 
poppy  holds.  The  FARC  gunned  down  U  police 
omcers  and  wounded  17  others. 

This  summit's  context  of  violence  highlights 
how  brutal  guerriliaand  paramilitary  tactics  con - 
Umie  to  be.  Commanders  for  the  FARC,  which  has 
effecm^e  control  of  about  40  percent  of  the  coun- 
declined  even  to  attend  the  summit  But  the  rob 
attves  ofllpeopie  Iddnapped  by  toe  Em  in  the 
.  praig  of  19^  were  there,  lobbying  for  the  release 
of  their  loved  ones.  The  ELK’S  chief,  Antonio  Gar- 
cia  ga^-e  them  little  hope,  pre-empting  the  summit 
hi  saying  that  neither  the  issue  of  hostages  nor  a 
cease-fire  would  be  on  the  table  for  discussion 


*  ««“/one  aoout  one  year  ago  and  an  ombudsman 
appointed  by  Congress  has  documented  41  disap- 
pe^-ances  in  the  territory  at  the  hands  of  the 
MRL.  The  territory  was  ceded  asaland  for  peace 
deal,  but  the  E4KC  now  uses  the  demiiitarized  zone 
asa  base  of  illegal  operations  and  has shown  no  will 
whatsoever  to  negotiate  a  peace.  ■ 

Former  Colombian  Police  Chief  Jose  Serrano 
v*o  was  in  Washington  last  week  to  recem  tfie  ' 
D Em  special  agent  award,  described  the  growing 
hnlvguemOa  and  paramilitary  groups  have  formed 
with  drug  traffickers,  giving  terrorists  access  to 
V^t  resources  to  buy  guns.  ‘After  the  iron  curtain 
fell,  and  subversives  stopped  receiving  money 
from  the  former  Soviet  Union  or  Cuba,  the  FARC 
began  attacking  us  whan  we  fumigated  fcoca] 
crops,  Mr.  Serrano  told  The  Washington  Times! 
Mr.  Pastrana  s  plan  to  achieve  peace  through  coun- 
ternarooocs  initiatives  and  social  projects  is  there- 
fore  khe  last  chance  that  we  Colombians  have. 
Because  if  it  fails*  we  will  have  to  make  our  peace 
wer  corpses;*  he  said.  No  one  should  want  that 
Colombia  has  seen  enough  suffering. 
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Who  Needs  Big  Brother 
When  There’s  ‘Carnivore’? 


*  emoreement:  The  FBI 
should  not  be  granted  such 
sweeping  powers  to  search  our 
e-mail  and  then  be  trusted  to 
police  itself. 


%barTkosko  - - 

Now  the  FBI  wants  to  recruit  Internet 
service  providers,  or  ISPs,  to  spy  on  U.S. 

raj  already  WOf>tswith  the 
credit  companies  ta  secretly  snoop  or 

pe7X1!99fi  fe  ****  €wtt  “P*«* 

Act  tL  pwi”  *8isewe  Authorisation 
Act  The  FBI  has  installed  digital  phone- 
tappmg  equipment  directly  in  phone  com¬ 
panies  under  a  similar  congressional  act 
passed  m  3394.  And  the  Treasury  Depart* 
Enforcement 

Ae.wort.  has  deputised"  all  banks  to 
monitor  our  bank  accounts  and  to  se- 
cretiy  foe  "suspicious  activity  reports" 
that  n  shares  with  the  FBI  and  IRS  and 
even  with  some  foreign  governments. 

The  FBI  calls  iU  new  IS?  surveillance 
?;Z3r*  Owjwt"  An  agent  connects 
a  Iap.op  to  the  ISP  server  and  then  reads 
at  least  the  address  of  every  e-mail  mes¬ 
sage  that  passes  through  the  server.  The 
FBI  says  it  has  used  its  Carnivore  soft* 
ware  limes  in  the  last  two  years  to 
search  for  terrorists  or  drug  dealers  or 

71,6  Fm  ^ims  that 
it  needs  this  search-'em^U  software  to 

tfL  fJ  ^  catch  such  criminals 
when  they  use  the  Internet. 

There  are  three  problems  with  Carni¬ 
vore,  and  each  is  fatal  The  first  is  that 
Carnivore  undermines  the  4th  Amend¬ 
ment  &  ban  m  unreasonable  searches— if 
it  does  not  violate  it  outright.  The  FBI 

a  Wff*  to  issuer  search 
warrant  based  on  '"probable  ciuse^  This 

me3n  m  ******  that 
ibe  FBI  asks  for  the  warrant  But  the  4th 
Amendment  further  demands  that  the 
^r^ni  &  specific —^particulariy  de- 
scribing  the  place  to  be  searched,” 

Carnivore  searches  blindly  thronsh  all 
private  e-rnaiis  that  flow  through  the  ISP 
server  while  it  looks  for  a  suspicious  few. 

1  ff  m  police  have  a  warrant  to 
search  someone's  bedroom  closet  and 
a]i  ^u*es  m  a  city  until  they 
imd  i  t  The  search  itself  invades  privacy 
Carnivore  switches  the  order  of  search 

Td  washes 

iiret  identify  the  subject's  property 

w'hich  is  then  searched.  Carnivore 
parches  through  private  databases  until 
(t  identifies  a  suspect's  property-and 


”  v  '  tT"  ;  swag  the 

This  is  a  big  leap  down  the  slippery 
slope  of  state  invasion  of  privacy.  And 

exJstence  of  web  a  monitoring 
f  S??aces  3  chi!'‘ng  effect  on  l 
bec«iS«  toeing 

tort  !,«  Ir  P°!tce  aSency  read  at 

SS5K.TSSC”"*"“U 

doSnnSr?^”5  iS  that  the  *W 

o^s  not  need  Carnivore  to  search  for  al¬ 
leged  criminal  e-mails.  Rep,  je^n 
£*?***•  ®«teW  raised  this  issue 
S/®  Assistant  Director  Donald  Kerr 
Jk®* k®t  testified  before  Congress  at  a 
hearing  Monday  on  Carnivore:  “Why  do 

^‘Zlhi0  on  sit«  at  the 

JbPs  rather  than  Jet  the  ISP  itself  turn 

much  in  the  way 
in  at  telephone  camps  n  ies  do?>f 

n,5e!I  CCl2^ed  lfli$  P°inl  but  claimed 
ftba'  *fe™  sWI  Carnivore  for 

Thk  k  oi?  ,thal  !act:  filtcrtnS  software. 

I  he,  is  plainly  specious:  The  FBI  or  over- 

^ht  sources  could  simply  give  such  ISPs 
tffe  ft  tenng  software.  There  is  simply  no 
need  to  grant  the  FBI  such  sweeping 

?arch  31,(3  thm  trust  the 
t*?1*?}  0  Pt&ce  itself  as  those  powers  in¬ 
evitably  grow- in  time. 

tiMB!.tbir<?,fob!em  * ti,at  Carnivore  ul- 

costs  Th*  *?V°rk  aesPRe  a!1  Its 
costs.  The  enmtnals  it  tries  to  watch  are 

‘^*7  P®^te  **«*  will  take  the  two  ob- 
thJir  f  tPS  ev1de  it;  TheF  change 
th^v  if«  *  *glta  1Ds  more  often,  and 
tne>  will  use  ever  more  powerful  dieiia} 
encryption  to  scramble  their  messages 

nerfn^irres  ^°,f£war®  blueprints  and 
”fe,^ujrks  ^emselver,  waj  ieatr 
‘°  be  *^tal  underground  despite  or  be- 

**“*?  °f,lhe.b5st  efiorts  of  dose  in  Con¬ 
gress  or  the  judiciary  who  oversee  it  And 

*£?Jf  study  the  software 
system  and  maybe  crack  g,  ■*:■■■>  .  v  . 

The  only  people  Carnivore  can  confi¬ 
dently  watch  are  the  innocent  citisens 
whom  it  has  no  right  to  watch.  This" 

foohsh  and  dangerous  precedent  for  the 
type  of  heavy-handed  government  sur 

KSSSCT  «*“  »  r«  “ 
^SiS^TJSS!TJf 


^  wBsuHiuoirai  limits 
**”*  ^  Congress  should 


*?JiA?sk<>  w«Pro/«wr  of  electrical 
"TSh?*s\tng  <*w  author  ^ 

mt>  v  (RaTidam  HoZ 


<^)e^Urgork®imes 

Microsoft  Files  Brief Ashing  Supreme  CourttoSm 


»y  STEVE  LOHR 

In  a  legal  document  filed  yester- 
^y,  Microsoft  argued  that  the  guv* 
ernme/>t  s  antitrust  case  is  "com. 
pleteiyunmitabie  for  direct  appeal" 
to  the  Supreme  Court  because  it  is 
compiejc  and  because  the  trial  ju{w 
•  ,tnade  serious  and  substantive  pro¬ 
cedural  errors."  * 

itS  «*N  t<»  gO 
£*»  the  federal  appeals  court  in 
Washington,  which  ruled  in  favor  of 
thecompaay  in  a  related  case 

wtm  3rgumem,  filed 

wtth  the  supreme  Court,  rests  beav- 

«r  w!  S“,i,lng  attack  on  the  work 
of  Judge  Thomas  Penfieid  Jackson 
who  heard  the  lawsuit  in  Federal 
District  Court.  federal 

The  Microsoft  document,  citing  in- 

S  JU<,gC  Jatks°n  granted  to 
new  organizations,  including  The 


t0rf  ^f^3rtrm  a»«»«Wc t  court 

oersuarfAru8’  M,crosoft *s  trying  to 
persuade  the  court  that  the  aoixaf 

will  involve  a  thicket  of  tecfEt 

fesues,  procedural  challenges  smi 

S*K  wffl  Involve  potv 

S-ssk 

ment  had  no  comment  yesterday. 

77*  e  software 
company  says  the 

trial  judge  made 
procedural  errors . 


prem? *5,Mct,T  to  the  Su- 
from  the  outset”  ~r?lt-l>a%  awry 

rfsSe,,^!  to  -fudge 

S  tf"S^«-^anad 

yond  recognition  ”  in  rf„-lr  case  He- 
era  soft  declared  I"  *®«  so,  Mt- 
“committed  an  wrav  of  J  u<iee 

cludtf  giv^toe  coerOSOft  «** ..to* 

tiroe  for  discovery  and3”^  t0° 
of  its  defense  to  thl  ^n,£?!paration 
of  evidence.  '  landing  array 


S?  y°r*TiTs'  sta£«<f.  "The  dis- 
c»urts  blunt  comments  to  the 

L  fmnaiSeiSeri°aS  *»“**&*»  about 
iraparuaiity  “ 

gf  ~««SSwK»S5S; 

ZJ<  Jums  fce  company  to 
Sr  ,^e'r  Case-  ^cn.  after  It 
lowing  the  additional  evidence 

thai’htft^  assorsd  *f»  company 
*e  more  lfm'?£S  W0Uit!  *  *****  on 

acr^L,  ^'  or‘8ina)  complaint, 
according  to  the  Microsoft  filing. 

sutedS"tlitS;fUraf!CeS''  comPanv 
^iate"  C'C0Urt  WttW  '**r 

vearth«i*CkS0“  «ther  this 
m  «  k  i  M,cmof  1  was  a  monopolist 

he  la^er^sheived  pending  7^*** 

aUK  I,**  ATS 

up  to  two 

l  ^56  government  is  seekm* 

the  Supreme  riu.^T1  8  to 
appeal direcilva^f ttrt  ^ar'toe 

%  a  fedeSf 

appeals  to  the  catttil  COefL  Direc! 
fI»jor  antitrust  Mses  fa 

government.  Ft^-  ib.Wti>y  ti,e 


a  brief  smfcfriem  saying 

.Srv”““‘  "wi!t  re«  *» 

whnf  »i?Bre  iS  !ittte  mystery  about 
’‘“f  w  govccuotent's  theme  wilt 

S?hth  'V  **  wh<ai  iE  fi!es  ‘fs  brief 
wtth  the  court  on  Aug.  15.  First,  ac- 

meffu  ■«  lega!  ****”*•  che  govem- 
M t  will  say  that  the  factual  find¬ 
ings  are  clear  and  that  the  issues  for 
appeal  are  «  couple  of  big  legal  q«es. 
ons  ~  precisely  the  kind  of  major 
judgments  of  Jaw'  that  the  court  so 
men  reserves  for  itself, 

whww  gJ*eai  ‘f ues-  *ey  *ay>  a« 

whether  Microsoft's  bundling  of  its 
Internet  browser  with  its  industry- 

cPemto®  system 
was  an  illegal  tying  of  two  products 

«dtfi  om  a®r  Mkrosofs's  balings 
With  other  companies  was  indeed 

mom>poiumg  conduct/'  in  Wa! 
pariaim  Judge  Jackstm  ruled  that 
Microsoft  s  bundling  move  and  its 
behavior  did  violate  antitrust  laws 
sndMicrosoft  is  appealing  his  ruling 
The  government  is  also  expected 

for"t^e  a±,reefa!  P°!ic}'  argument 
for  the  expedited  appeal,  given  the 
importance  of  computer  industry  to 
the  economy.  J 

,.3f.g0Ven!mem'‘1ii  sa>'  that  Mi¬ 
crosoft  s  monopoly  is  imposing  a  sic- 

ms  appeal  and  no  remedies  are  in 
P‘af'  *»<«  Herbert  Havenkamp  a 

fawfsriw/-'rIht  ",!iversHy  °f  lm 

law  seftooi.  n  will  say  that  not  tak* 
ing  the  case  is  a  costly  aci<  aod  that 
this  U  exactly  th e  kind  of  case  that 


Miriwf  the  evi<fence  “  the  case 
Mve 

able  for  i!  !  as.,,ot  ^g  suit- 

district  coun^  Tr,1”  eoutI-  “The 

"iar™L C  Urt'  Microsoft  stated 

the  flfera?Wiiemte<J  aPPiication  of 
me  federal  rules  of  evidence  admiT 

arsrsarsTE 

,fi3t  Microsoft  submitted 
wm>  newspaper  articles,  even  pr^s 
releases,  as  evidence.  P  ss  ' 

th«B1h?eJ^fm",8Rt  ro3««ained 
“a‘Jf>«  «sltf»tional  evidence  ore- 

compiaint  was  fded 

pSrt  Of  tljft  nf  srv^i 

SSfKS  practices  MtooToft 
“sea  to  stifle  competition.  Thus  the 

the  ^^itionoUri 

^  waf  Sfi>anies  iiks  Mtef 

the  ori£L,f  00  m  mansion  of 

&2££S^fi~* 

ag,ratk  tHe  government 

suggested 

before  Judge  Jwffll? 

SrJ*?  to  the 

should  be  considered  grounds  for  a 
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July  11,2000 


VIA  FAX 

Hon.  Charles  T.  Canady,  Chairman 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg, 
Washington,  D.C.  20515-6220 

and 

Hon,  Melvin  L.  Watt,  Ranking  Member 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg. 
Washington,  D.C.  20515-6220 

Dear  Representatives  Canady  and  Watt; 


We  are  writing  to  you  about  the  new  FBI  email  surveillance  system  aptly  named  "Carnivore," 
which  gives  law  enforcement  extraordinary'  power  to  intercept  and  analyze  huge  volumes  of 
email.  The  Carnivore  system  gives  law  enforcement  email  interception  capabilities  that  were 
never  contemplated  when  Congress  passed  the  Electronic  Communications  Privacy  Act 
(ECPA),  codified  in  relevant  part  at 1  8  U.S.C.  2510-22  and  1 8  USC '3121-27.  Carnivore  raises 
new  legal  issues  that  cry  out  for  Congressional  attention  if  we  are  to  preserve  Fourth 
Amendment  rights  in  the  digital  age. 


The  existence  of  Carnivore  first  came  to  light  in  the  April  6  testimony  of  Attorney  Robert 
Com-Revcre  to  the  Constitution  Subcommittee,  Its  operation  was  further  detailed  in  a  report 
that  appeared  in  today's  Wall  Street  Journal  (copy  attached).  According  to  these  reports,  the 
Carnivore  system  -  essentially  a  computer  running  specialized  software-  is  attached  directly 
to  an  Internet  Service  Provider's  (ISP)  network.  Carnivore  is  attached  either  when  law 
enforcement  has  a  Title  III  order  from  a  court  permitting  it  to  intercept  in  real  time  the 
contents  of  the  electronic  communications  of  a  specific  indi  vidual,  or  a  trap  and  trace  or  pen 
register  order  allowing  to  i  t  obtain  the  "numbers"  related  to  communications  from  or  to  a 
specified  target. 

But  unlike  the  operation  of  a  traditional  a  pen  register,  trap  and  trace  device,  or  wiretap  of  a 
conventional  phone  line.  Carnivore  gives  the  FBI  access  to  all  traffic  over  the  ISP’s  network, 
not  just  the  communications  to  or  from  a  particular  target.  Carnivore,  which  is  capable  of 
analyzing  millions  of  messages  per  second,  purportedly  retains  only  the  messages  of  the 
specified  target,  although  this  process  takes  place  without  scrutiny  of  either  the  ISP  or  a  court. 

Carnivore  permits  access  to  tire  email  of  every  customer  of  an  ISP  and  the  email  of  every 
person  who  communicates  with  them.  Carnivore  is  roughly  equivalent  to  a  wiretap  capable  of 
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accessing  the  contents  of  the  conversations  of  ail  of  the  phone  company’s  customers,  with  the 
"assurance**  that  the  FBI  will  record  only  conversations  of  the  specified  target.  This  "trust  us, 
we  are  the  Government"  approach  is  the  antithesis  of  the  procedures  required  under  our  the 
wiretapping  laws.  They  authorize  limited  electronic  surveillance  of  the  communications  of 
specified  persons,  usually  conducted  by  means  of  specified  communications  devices.  They 
place  on  the  provider  of  the  communications  medium  the  responsibility  to  separate  the 
communications  of  persons  authorized  to  be  intercepted  from  other  communications. 

Currently,  law  enforcement  is  required  to  ’’minimize”  its  interception  of  non-incriminating 
communications  of  a  target  of  a  wiretap  order.  Carnivore  is  not  a  minimization  tool.  Instead, 

Carnivore  maximizes  law  enforcement  access  to  the  communications  of  non-targets" 

in  his  testimony  to  your  subcommittee  Mr.  Com-Revere  described  the  experience  of  his  client, 
an  ISP  that  was  required  to  install  Carni  vore  when  presented  with  a  trap  and  trace  order.  He 
detailed  his  client's  concerns  that  a  trap  and  trace  order  in  the  context  of  the  Internet  revealed 
information  that  Congress  did  not  contemplate  when  it  authorized  their  limited  use.  In  the 
traditional  telephone  context,  those  orders  reveal  nothing  more  than  the  numbers  dialed  to  or 
from  a  single  telephone  line.  In  the  Internet  context,  these  orders  and  certainly  Carnivore, 
likely  involve  ascertaining  the  suspect’s  e-mail  address,  as  well  as  header  information  that  may 
provide  information  regarding  the  content  of  the  communication. 

As  we  have  stated  previously,  the  ACLU  does  not  believe  that  it  is  clear  that  the  Government 
can  serve  an  order  on  an  Internet  service  provider  and  obtain  the  e-mail  addresses  of  incoming 
and  outgoing  messages  for  a  particular  subscriber.  Further,  it  is  not  clear  whether  law 
enforcement  agents  use  or  should  use  authority  under  the  pen  register  statute  to  access  a 
variety  of  data,  including  Internet  Protocol  addresses,  dialup  numbers  and  e-maii  logs.  We 
certainly  do  not  believe  that  it  is  clear  that  law  enforcement  can  install  a  super  trap  and  trace 
device  that  access  to  such  information  for  all  of  an  ISP’s  subscribers. 

In  light  of  the  new  revelations  about  Carnivore,  the  ACLU  urges  the  Subcommittee  to 
accelerate  its  consideration  of  the  application  of  the  4th  Amendment  in  the  digital  age. 

Legislation  should  make  it  clear  that  law  enforcement  agents  may  not  use  devices  that  allow 
access  to  electronic  communications  involving  only  persons  other  than  a  specified  target  for 
which  it  has  a  proper  order.  Such  legislation  should  make  clear  that  a  trap  and  trace  order 
served  on  an  ISP  does  not  authorize  access  to  the  contents  of  any  communication  -  including 
the  subject  line  of  a  communication  -  and  that  the  ISP  bears  the  burden  of  protecting  the 
privacy  of  communications  to  which  FBI  access  has  not  been  granted. 

We  would  be  happy  to  work  with  the  Subcommittee  on  drafting  legislation  that  protects  the 
privacy  rights  of  Americans. 

Sincerely, 

Laura  W.  Murphy 

Director,  ACLU  Washington  National  Office 

Barry  Steinhardt 
Associate  Director,  ACLU 

Gregory  T.  Nojeim  -II 
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Legislative  Counsel,  ACLU  Washington  National  Office 

cc:  Members  of  the  Constitution  Subcommittee  of  the  House  Judiciary  Committee 
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Stronger  Online  Privacy  Sought 

By  D.  IAN  HOPPER 

x  The  Associated  Press 


WASHINGTON  (AP)  -  Lawmakers  are  seeking  ways  to  shore  up  online  privacy  following  reports  of  businesses  selling  custom* 
persona!  information  and  an  FBI  system  that  hunts  for  suspects  by  scanning  citizens’  e-mail. 

Sens.  Patrick  Leahy,  Q-Vt,  and  Robert  Torricelli,  D-N.J.,  introduced  legislation  that  would  bar  the  sate  of  personal  information 
kept  by  a  defend  company  if  the  sale  would  have  violated  privacy  policies  in  effect  when  the  company  was  in  business. 

Ihe  bit!  responds  to  the  case  of  Toy  smart,  a  former  online  toy  retailer  that  put  all  Its  assets,  including  Its  customer  records  - 
such  as  names,  addresses  and  credit  card  numbers  -  up  for  sale  despite  a  privacy  policy  that  assured  customers  the  informal 
would  remain  private. 

The  Federal  Trade  Commission  filed  a  suit  against  Toysmart  this  week  to  stop  the  sate  from  taking  place.  Rep.  Spencer  Bach 
R-Ala.,  has  already  announced  plans  to  Introduce  a  similar  bii!  In  the  House. 

”1!  is  wrong  to  use  our  nation’s  bankruptcy  laws  as  art  excuse  to  violate  a  customer's  persona!  privacy,*  the  senators  said  in  a 
tetter  to  colleagues  asking  for  support  for  the  bill.  "Customers  have  a  right  to  expect  a  firm  to  adhere  to  its  privacy  policies, 
whether  it  is  making  a  profit  or  has  filed  for  bankruptcy,* 

The  legislators  say  they  will  try  to  include  the  bill  In  a  larger  bankruptcy  reform  package. 

TRUSTe,  an  organization  that  gives  its  sea!  to  Web  sites  that  meet  its  privacy  principles,  blew  the  whistle  on  Toysmart  in  duns 

Earlier  Wednesday,  Waif  Disney,  the  majority  owner  of  Toysmart,  said  it  has  offered  to  purchase  the  company's  fists  and  assure 
their  confidentiality.  *  f 

in  a  related  action,  two  legislators  are  going  after  "Carnivore,”  a  system  in  use  by  the  FBI  to  monitor  suspected  criminals’  e-m;  iff. 
Carnivore  is  installed  at  a  suspect’s  Internet  provider  and  scans  through  ail  incoming  and  outgoing  mail,  looking  for  messages 
belonging  to  the  suspect. 

Privacy  groups,  such  as  the  American  Oral  Liberties  Union  and  the  Electronic  information  Privacy  Center,  and  some  internet 
providers  object  to  the  system  because  internet  companies  have  no  control  over  the  "black  box.”  They  say  it  infringes  upon  ths  i 
rights  of  individuals  not  involved  with  the  FBI  investigation. 

The  ACLU  sent  a  fetter  to  Rep.  Charles  Canady,  R-Fls.,  detailing  its  concerns.  Canady  will  announce  Thursday  the  date  for 
hearings  on  Carnivore,  his  spokesman  said. 

House  Majority  Leader  Dick  Armey  sent  a  tetter  Wednesday  to  Attorney  Generai  Janet  Reno  and  FB!  Director  Louis  Freeh 
blasting  the  agencies  and  the  Clinton  administration  for  the  "cybersnooping*  system. 

The  federal  government  has  the  power  and  the  authority  to  collect  and  maintain  vast  amounts  of  private  personal  information,” 
wrote  Armey,  R-Texas.  "This  administration  continues  to  demonstrate  a  cavalier  attitude  with  that  responsibility, * 

Also,  Rep.  Clay  Shaw,  R-Fta.,  will  introduce  a  bil!  Thursday  aimed  at  stopping  identity  theft.  The  bill  would  prohibit  the  sate  of 
Social  Security  numbers,  which  can  be  used  to  get  credit  card  numbers,  bank  loans  and  accounts  in  another  person's  name. 

The  FTC  announced  Wednesday  that  calls  to  their  identity  theft  hot  line  are  on  the  rise,  at  about  850  reports  per  week. 

"Identity  theft  is  a  terrible  problem  that  has  literally  destroyed  people’s  lives  and  it  must  be  stopped,”  said  Shaw  who  heads  (hi  i 
House  Social  Security  subcommittee. 
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FBI  Cybersnooping  System  Raises 
Additional  Privacy  Concerns 

Armey  to  Administration:  Stay  Out  of  My  Inbox! 
July  12, 2000 


Related  Links 

The  e-Contract 

Remafe  trn  t»ee- 
Contract  with  High 
Tech  America 


FBI  Cybersnoopmg 
SvstemRaises 


House  Majority  Leader  Dick  Armey  today  called  on  Attorney 
General  Janet  Reno  and  FBI  Director  Louis  Freeh  to  address  the 
privacy  concerns  raised  by  the  Federal  Bureau  of  investigation's 
Carnivore  system  of  monitoring  email  traffic.  Armey  issued  the 
following  statement: f 


This  Administration  doesn't  have  the  best  record  on  persona!  privacy.  It 
keeps  repeating  the  same  mistake  over  and  over. 


Only  Violate 
Personal  Privacy  in 


fe  the  Government  in 

About  internet 
Emm! 


Last  year,  a  draft  Administration  proposal  for  a  computer  network 
monitoring  system  called  FIDNet  surfaced.  When  I  joined  privacy 
advocates  in  questioning  the  legitimacy  of  a  government  system  that 
could  monitor  private  sector  networks,  the  Administration  backed  off 
a  bit  from  their  original  design.  But  it  has  yet  to  answer  my  question  of 
why  they  intended  to  monitor  private  systems  in  the  first  place. 


Now  the  FBI  wants  to  run  a  system  that  could  sort  through  every'  single 
e-mail  message  that  passes  through  a  commercial  Internet  sendee 
provider.  I  ask,  why  should  we  trust  this  Administration  with  our  most 
personal  correspondence? 

At  a  time  when  there  is  a  lot  of  talk  about  concerns  for  Internet  privacy, 
the  Ciinton-Gore  Administration  continues  to  push  Big  Brother 
proposals  that  promote  government  cybersnooping.  They  seem  tone  deaf 
to  the  concerns  people  have  about  the  government  invading  their 
privacy.  The  Federal  government  has  the  power  and  the  authority  to 
collect  and  maintain  vast  amounts  of  private  personal  information.  This 
Administration  continues  to  demonstrate  a  cavalier  attitude  with  that 
responsibility. 

I  call  on  Attorney  General  Reno  and  FBI  Director  Freeh  to  stop  using 
this  cybersnooping  system  until  fourth  amendment  concerns  are 
adequately  addressed. 

Rotated  Correspondence: 

*  First  letter  to  AG  Reno 

*  Second  letter  to  AG  Reno 

*  Third  letter  to  AG  Reno 

*  Privacy  violations  at  ONDCP 

*  Letter  to  the  president  on  web  privacy 


http://freedom.house.gov/library/technology/camivore.asp 
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Diagnostic  Tool 


2mS  ^ti^Tmu?^!i0ns  n?tW0fks^re  routine|y  used  m  the  commission  of  serious 
SS  S'  including  espionage.  Organized  crime  groups  and  drug  trafficking 
acSes  y  y  Up0a  telecommunications  to  plan  and  execute  their  crffiai 

^f,!Lflaw  enforcement  agencies  to  conduct  lawful  electronic  surveillance  of  the 
su® 

based  upon  a  defendant’s  own  words.  r  ,  ie  factuai  tssues 

1PP!-G3{i<SI  f?r  Perception  rec!uire  tt16  authorization  of  a  high-level 
Department  of  Justice  (DOJ)  official  before  the  iocal  United  States  Attorneys  offices  can 

hSrJctH UCh  0r5erS/ lntercep!i0?  orders  must  be  filed  with  federaiS|ycoSdq?s  or 

federal  maoisSs  aie  nnf^Sf *i0n' Hence'  uKniike  typicai  sesr^  warrants^9 
^aS'Strete$  are  not  authorized  to  approve  such  applications  aid  orders  Further 

interception  of  communications  is  limited  so  certain  specified  federal  feiony  offenses 

Applications  for  electronic  surveillance  must  demonstrate  probable  cause  and  sta<e 
part.culanty  and  specificity;  the  offensefs)  being  committed,  the  teSmunications  faring 
or  ptace  from  which  the  subject's  communications  are  to  be  interested  a  description  of  ^ 
fee  types  of  conversations  to  be  intercepted,  and  the  identities  of  the  persons  committino 
he  offenses  that  are  anticipated  to  be  intercepted.  Thus,  criminal  elXnfc liS2S25? 
laws  focus  on  gathering  hard  evidence  --  not  intelligence.  unemance 

Applications  must  indicate  that  other  normal  investigative  techniques  wflf  not  work  or  are 
too  dangerous,  and  must  include  information  concerning  any  prior  etectronic  survJlwt 

interceptions  must  terminate  sooner  if  the  objectives  are  obtained.  Judoesmav  fanrf 

Dmor^fifihf-T  pe!ifiC  C00ft  (typicaliy  every  7-10<4s)  adXnaft  of  the 

^ressofthe  interception  effort  This  circumstance  thus  assures  dose  and  ongoing 

bl  ibl United  Sta{es  Attorney's  office  handling  the 
°1  * e  ord?r  (cons|Sfent  with  requirements  of  the  initial  application  lire6 
permitted,  if  jus  tified,  for  up  to  a  period  of  30  days.  ' 8re 

fanoTffr»nU^ii{snCe  hfa?  been  ex![erne!y  elective  in  securing  the  conviction  of  more 
than  25,800  dangerous  fetons  over  the  past  13  years,  in  many  cases  tiers  k  no  <*<* 

SSS6,  aS  *"  evtdence  Cannot  bs  obtained  •«»*  Other  traditiS 

feSS 

=hi^?Vr^te-W-h  feir  victims.  Because  many  internet  Service  Providers  (ISP)  iacked  the 
abii  ty  to  discriminate  communications  to  identify  a  particular  subject’s  messages  to  the  n 
exclusion  of  all  others,  the  FBI  designed  and  developed  a  diagnostic  Jcald  Carnivore. 

The  Carnivore  device  provides  the  FBI  with  a  "surgical”  ability  to  intercept  and  collect  the 
communications  which  are  the  subject  of  the  lawful  order  while  ignoring  those  6 

communications  which  they  are  not  authorized  to  intercept.  This  type  of  too!  is  necessary 
to  meet  the  stringent  requirements  of  fee  federal  wiretapping  statutes.  necessary 

The  Carnivore  device  works  much  tike  commercial  "sniffers*  and  other  network  diaonmiir 
.cols  used  by  ISPs  every  day,  except  that  it  provides  fee  FBI  wife  a  unique  ability  to  °S 
distinguish  between  communications  which  may  be  lawfully  intercepted  and  those  whirh 
may  not  For  example,  if  a  court  order  provides  for  fee  iawtul  interception  of  one  tvoe  of 
communication  (e.g.,  e-mail),  but  excludes  al!  other  communications  feg  online^ 
shopping)  the  Larnivore  tool  can  be  configured  to  intercept  only  those  e-mails  being 
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transmitted  either  to  or  from  the  named  subject,  ^ 

Carnivora  serves  to  limit  the  messages  viewable  by  human  eyes  to  those  which  am 

^SS'S,SS',d?S:,sp  “9e  "*«*»£. »  •S-SSSS52' 


tool  irtrt  L  l  <  penalties  tor  misuse  of  the 

rtr%i  osion  of  evidence*  as  weii  as  criminal  end  civil  penalties  The  system 

not  suicepisbie  to  abuse  because  it  requires  expertise  to  instail  and  operate  and  such  3 
j§£*"*  we  BS  requw  in  He  coSrt  orders,  with' SS.’SSg&l  Xte 

j®  sharing  information  regarding  Carnivore  with  industry  at  this  time  to  assist  ih^m " 
foinT&n^rtl  tfiinrf  f^Piementetion  Section,  at  an  industry  standards  meeting  (the 
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Statement  for  the  Record  of 
Donald  M.  Kerr 
Assistant  Director 
Federal  Bureau  of  Investigation 
Before  the 

United  States  House  of  Representatives 
The  Committee  on  the  Judiciary 
Subcommittee  on  the  Constitution 
Washington,  DC. 

7/24/2000 

Good  afternoon,  Mr.  Chairman,  and  Members  of  the  Subcommittee.  I  am  grateful  for  this 
opportunity  to  discuss  the  FBI's  Internet  and  data  interception  capabilities  and  to  help  set  the 
record  straight  regarding  tins  important  issue.  I  would  like  to  first  discuss  the  FBI’s  legal 
authority  for  conducting  interceptions  on  the  Internet,  and  then  describe  the  technical  means  by 
which  we  intercept  Internet  communications  in  order  to  obtain  evidence  of  Federal  felonies. 

Two  weeks  ago,  the  Wall  Street  Journal  published  an  article  entitled  "FBI's  system  to  covertly 
search  E-mail  raises  privacy,  legal  issues  ”  This  story  was  immediately  followed  by  a  number  of 
similar  repot  ts  in  the  press  and  other  media  depicting  a  part  of  our  interception  software  - 
codenamed  Carnivore  as  an  ominous  new  technology  that  raised  concerns  about  the  possibility  of 
its  potential  to  snoop,  without  a  court  order,  into  the  private  E-mails  of  American  citizens.  I 
think  that  it  is  important  that  our  statutory  law  enforcement  authorities  be  discussed  openly.  In 
fact,  this  was  the  reason  we  chose  to  share  information  about  this  capability  with  industry  experts 
several  weeks  ago.  As  technology  continues  its  rapid  evolution,  it  is  essential  for  the  public  to 
know  and  understand  their  government  is  scrupulously  observing  the  laws  and  the  constitutional 
protections  that  guarantee  their  right  to  privacy.  It  is  also  very  important  that  these  discussions  be 
placed  into  their  proper  context  and  that  the  relevant  facts  concerning  this  issue  are  made  clear.  I 
welcome  this  opportunity  to  stress  that  our  capabilities  are  used  only  after  lawful  court  ordered 
authorization  and  that  they  are  directed  at  the  most  serious  violations  of  national  security  and 
public  safety. 
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The  FBI  performs  interceptions  of  criminal  wire  and  electronic  communications,  including 
Internet  communications,  under  authorities  derived  from  Title  HI  of  the  Omnibus  Crime  Control 
and  Safe  Streets  Act  of  1968  (as  amended),  which  is  commonly  referred  to  as  "Title  IIP,  and 
portions  of  the  Electronic  Communications  Privacy  Act  of  1986  (as  amended),  or  ”ECPA"  Ail 
such  interceptions,  with  the  exception  of  a  rarely  used  "emergency"  authority  or  in  cases  involving 
the  consent  of  a  participant  in  the  communication,  are  conducted  pursuant  to  court  orders.  Under 
emergency  provisions,  the  Attorney  General,  the  Deputy  or  the  Associate  Attorney  General  may, 
if  authorized,  initiate  electronic  surveillance  of  wire  or  electronic  communications  without  a  court 
order,  but  only  if  an  application  for  such  order  is  made  within  48  hours  after  the  surveillance  is 
initiated.  Last  year,  the  FBI  obtained  Title  ill  court  orders  in  327  instances.  We  did  not  initiate 
surveillances  under  emergency  provisions  of  Tide  III. 


Federal  surveillance  laws  supplement  the  Fourth  Amendment's  dictates  concerning  reasonable 
searches  and  seizures  to  oral,  wire  and  electronic  communications.  They  also  include  a  number  of 
additional  provisions  which  ensure  that  this  investigative  technique  is  used  judiciously,  with 
deference  to  the  privacy  of  intercepted  subjects. 

An  application  for  a  warrant  to  search  a  private  residence  must  be  presented  under  oath  to  a  judge 
or  magistrate  who  may  issue  the  warrant  only  upon  a  finding  of  probable  cause  to  believe  that  a 
crime  has  been  committed,  and  that  specified  evidence  of  the  crime  will  be  found  in  the  place  to 
be  searched.  Applications  for  Title  III  interceptions  of  wire,  oral  or  electronic  communications 
must  be  presented  to  judges  in  the  same  way  (magist  rates  are  not  authorized  to  approve  Title  ffi 
applications).  However,  before  the  application  can  even  be  submitted  to  the  court,  it  must  be 
authorized  by  a  senior  official  of  the  Department  of  Justice  (DOJ).  Title  III  requires  such 
high-level  approval  for  applications  to  intercept  oral  and  wire  communications,  except  in  the  case 
of  digital  pagers,  and  DOJ  policy  requires  the  same  level  of  approval  for  applications  to  intercept 
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electronic  communications,  even  though  the  law  would  allow  lower-level  approval. 


Applications  for  electronic  surveillance  describe  with  particularity  and  specificity  the  particular 
offenses  being  committed,  the  communications  facility  or  place  from  which  the  subject's 
communications  are  to  be  int  ercepted,  a  description  of  the  types  of  communications  to  be 
intercepted,  and  the  identities  o!  the  persons  committing  the  offenses  and  anticipated  to  be 
intercepted.  Under  Title  III,  electronic  surveillance  for  criminal  investigations  is  permitted  only 
for  the  purpose  of  gathering  hard  evidence-  not  intelligence. 


Applications  must  indicate  that  other  normal  investigative  techniques  have  been  tried  and  failed  to 
gather  evidence  of  crime,  or  wd!  not  work,  or  are  too  dangerous,  and  must  include  information 
concerning  any  prior  electronic  surveillance  regarding  the  subject  or  facility  in  question.  Court 
orders  are  initially  limited  to  30  days,  with  extensions  possible,  and  must  terminate  sooner  if  t  he 
objectives  are  obtained.  Judges  may,  and  usually  do,  require  periodic  reports  to  the  court, 
typically  every1  7  to  10  days,  advising  it  of  the  progress  of  the  interception  effort.  This  assures 
close  and  on-going  oversight  of  the  electronic  surveillance  by  the  United ‘States  Attorney's  office 
handling  the  case.  Interceptions  are  required  to  be  conducted  in  such  a  way  as  to  "minimize  the 
interception  of  communications  not  otherwise  subject  to  interception"  under  the  law,  such  as 
unrelated,  irrelevant,  and  non-criminal  communications  of  the  subjects  or  others  not  named  in  the 
application. 


To  ensure  the  evidentiary'  integrity  of  Intercepted  communications  they  must  be  recorded,  if 
possible,  on  magnetic  tape  or  other  devices,  so  as  to  protect  the  recording  from  editing  or  other 
alterations.  Immediately  upon  the  expiration  of  the  interception  period,  these  recordings  must  be 
presented  to  the  federal  district  court  judge  and  sealed  under  his  or  her  directions.  The  presence 
of  t  he  seal  is  a  prerequisite  for  their  use  or  disclosure,  or  for  the  introduction  of  evidence  derived 
from  the  tapes.  Applications  and  orders  signed  by  the  judge  are  also  to  be  sealed  by  the  judge. 
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Within  a  reasonable  period  of  time  after  the  termination  of  the  interception  order,  the  judge  is 
obligated  by  law  to  ensure  that  the  subject  of  the  interception  order,  and  other  parties  as  are 
deemed  appropriate,  are  furnished  an  inventory  that  includes  notice  of  the  order,  the  dates  during 
which  the  interceptions  were  carried  out  ,  and  whether  or  not  the  communications  were 
intercepted.  Upon  motion,  the  judge  may  also  direct  that  portions  of  the  contents  of  the 
intercepted  communication  he  made  available  to  affected  persons  for  their  inspection. 


A  variety  of  sanctions  are  available  to  penalize  interceptions  conducted  in  violation  of  Title  HI 
ECPA  and  the  Fourth  Amendment  The  evidence  obtained  through  such  unlawful  interceptions 
can  be  suppressed.  The  illegal,  unauthorized  conduct  of  electronic  surveillance  is  a  federal 
criminal  offense  punishable  by  imprisonment  for  up  to  five  years,  a  fine,  or  both.  In  addition,  any 
person  whose  communications  are  unlawfully  intercepted,  may  recover  in  a  civil  action  against  the 
person  or  entity  engaged  in  the  violation,  damages,  including  punitive  damages,  attorney's  fees 
and  other  costs. 


Once  we  obtain  an  order  for  surveillance  of  wire  communications,  we  generally  require  technical 
assistance  front  the  carrier  or  service  provider.  Such  help  is  increasingly  necessary  the  case  with 
the  advent  of  advanced  communications  services  and  networks  such  as  the  Internet.  The  days  of 
connecting  a  pair  of  ailegator  clips  connecting  a  tape  recorder  to  a  copper  wire  phone  are  long 
gone.  Title  HI  mandates  service  provider  assistance  incidental  to  law  enforcement’s  execution  of 
electronic  surveillance  orders.  Upon  the  request  of  the  applicant,  a  court  order  authorizing  the 
interception  of  communications  may  direct  that  a  telecommunications  “service  provider,  landlord, 
custodian,  or  other  person  shall  furnish  the  applicant  forthwith  all  information,  facilities,  and 
technical  assistance  necessary  to  accomplish  the  interception  unobtrusively  and  with  a  minimum  of 
interference  with  the  services  that  such  service  provider,  landlord,  custodian,  or  person  is 
according  the  person  whose  communications  are  to  be  intercepted.11 
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la  practice.  Judges  may  sign  two  orders:  one  order  authorizing  the  law  enforcement  agency  to 
conduct  the  electronic  surveillance,  and  a  second,  abbreviated,  assistance  order  directed  to  the 
service  provider,  specifying,  for  example  in  the  case  of  E-mail,  the  E-mail  account  name  of  the 
subject  tha  t  is  the  object  of  the  order  and  directing  the  provision  of  necessary  assistance. 

Service  providers  and  their  personnel  are  also  subject  to  the  electronic  surveillance  laws,  meaning 
that  unauthorized  electronic  surveillance  of  their  customers  (or  anyone  else)  is  forbidden,  and 
criminal  and  civil  liability'  may  be  assessed  for  violations.  The  prohibition  on  using  or  disclosing 
the  contents  of  communications  illegally  intercepted,  likewise  extends  to  service  providers  and 
their  personnel.  It  is  for  this  reason,  among  others,  that  service  providers  typically  take  great  care 
in  providing  assistance  to  law  enforcement  in  carrying  out  electronic  surveillance  pursuant  to 
court  order.  In  some  instances,  service  providers  opt  to  provide  “full"  service,  essentially  carrying 
out  the  interception  for  law1  enforcement  and  providing  the  final  interception  product,  but,  in  most 
cases,  service  providers  are  inclined  only  to  provide  the  level  of  assistance  necessary  to  allow  the 
law  enforcement  agency  to  conduct  the  interception. 


In  recent  years,  it  has  become  increasingly  common  for  the  FBI  to  seek,  and  for  judges  to  issue 
orders  for  Title  III  interceptions  more  narrowly  tailored  than  those  in  the  early  years  of  Title  III 
existence  that  were  directed  against  “plain  old  telephone  services.  ”  To  be  successfully 
implemented,  these  orders  require  complex  methods  to  ensure  that  only  messages  for  which  there 
is  probable  cause  to  intercept  are,  in  fact,  intercepted.  The  increased  detail  in  court  orders  issued 
under  Title  III  responds  to  two  relatively  recent  developments. 

First,  the  complexity  of  modern  communications  networks,  such  as  the  Internet,  and  t  he 
complexity  of  modern  users'  communications  equipment  require  better  discrimination  than  older 
analog  communications.  For  example,  Internet  users  frequently  use  electronic  messaging  services. 
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like  E-mail,  to  communicate  with  other  individuals  in  a  manner  reminiscent  of  a  telephone  call, 
only  with  text  instead  of  voice.  Such  messages  are  often  the  targets  of  court  ordered  interception. 
Users  also  use  services,  like  the  world  wide  web,  which  looks  more  like  print  media  than  a  phone 
call.  Similarly,  some  Internet  services,  like  streaming  video,  have  more  in  common  with  broadcast 
media  like  television,  than  with  telephone  calls.  These  types  of  communications  are  less  commonly 
the  targets  of  an  interception  order. 

Second,  for  many  Internet  services,  users  share  communications  channels,  addresses,  etc.  These 
factors  make  the  interception  of  messages  for  which  law  enforcement  has  probable  cause,  to  the 
exclusion  of  all  others,  very  difficult.  Court  orders  therefore  increasingly  include  detailed 
instructions  to  preclude  the  interception  of  communications  that  lie  outside  the  scope  of  the  order. 


In  response  to  a  critical  need  for  tools  to  implement  complex  court  orders,  the  FBI  developed  a 
number  of  capabilities  including  the  software  program  that  is  known  as  "Carnivore.”  The 
committee  may  be  aware  that  Internet  transmissions  are  broken  down  into  packets  of  information 
consisting  of  a  string  of  words  or  symbols.  Different  packets  from  the  same  message  often  take 
different  routes  between  the  sender  and  the  intended  recipient.  The  various  packets  constituting  a 
smgie  message  are  labeled  so  that  they  can  be  reassembled  and  read  by  the  recipient.  The 
challenge  for  law  enforcement  implementing  a  court  order  for  interception  of  E-mail  is  to  find  and 
retrieve  only  those  packets  that  are  part  of  a  message  covered  by  the  order.  To  do  this,  we 
developed  a  software  solution  to  perform  network  analysis.  This  software  runs  on  a  standard 
personal  computer  running  the  standard  Microsoft  Windows  operating  system.  It  works  by " 
sniffing"  the  proper  portions  of  network  packets  and  copying  and  storing  only  those  packets 
which  match  a  finely  defined  filter  set  programed  in  conformity  with  the  court  order.  This  filter  set 
can  be  extremely  complex,  but  it  provides  the  FBI  with  an  ability  to  collect  only  those 
transmissions  which  comply  with  pen  register  court  orders,  trap  &  trace  court  orders,  and  Title  ffl 
interception  orders. 
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it  is  important  to  understand  what  is  meant  by  “sniffing.  ”  The  problem  of  discriminating  between 
users*  messages  on  the  Internet  is  a  complex  one.  However,  this  is  exactly  what  our  software 
does.  It  does  NOT  search  through  the  contents  of  every'  message  and  collect  those  that  contain 
certain  key  words  like  “bomb”  or  "drugs."  It  selects  messages  based  on  criteria  expressly  set  out  in 
the  court  order,  for  example,  messages  transmitted  to  or  from  a  particular  account  or  to  or  from  a 
particular-  user.  If  the  device  is  placed  at  some  point  on  the  network  where  it  cannot  discriminate 
messages  as  set  out  in  the  court  order,  it  simply  lets  all  such  messages  pass  by  unrecorded. 

One  might  ask,  “why  use  this  program  at  all?"  In  many  instances,  ISPs,  particularly  the  larger 
ones,  maintain  capabilities  which  allow  them  to  comply,  or  partially  comply  with  lawful  orders. 

For  example,  many  ISPs  have  the  capability  to  “clone"  or  intercept,  when  lawfully  ordered  to  do 
so.  E-mail  to  and  from  specified  user  accounts.  In  such  cases,  these  abilities  are  satisfactory  and 
allow  full  compliance  with  a  court  order.  However,  in  most  cases,  ISPs  do  not  have  such 
capabilities  or  cannot  employ  them  in  a  secure  manner.  Also,  most  systems  devised  by  service 
providers  or  purchased  ’  off  the  shelf*  lack  the  ability  to  properly  discriminate  between  messages 
in  a  fashion  that  complies  with  the  court  order.  Also,  many  court  orders  go  beyond  E-mail, 
specifying  other  protocols  to  be  intercepted  such  as  instant  messaging.  In  these  cases,  a  cloned 
mailbox  is  not  sufficient  to  comply  with  the  order  of  the  court. 


Now,  I  think  it  is  important,  that  you  understand  how  we  use  the  system  in  practice.  First,  there  is 
the  issue  of  scale.  Carnivore  is  a  small-scale  tool  intended  for  use  only  when  and  where  it  is 
needed.  In  fact,  each  one  is  maintained  at  the  FBI  Laboratory  in  Quantico  until  it  is  actually 
needed  in  an  active  case.  It  is  then  deployed  to  satisfy  the  needs  of  a  single  case  or  court  order, 
and  afterwards,  upon  expiration  of  the  order,  the  device  is  removed  and  returned  to  Quantico. 

The  second  issue  is  one  of  network  interference.  Carnivore  is  safe  to  operate  on  I?  networks.  It  is 
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connected  by  a  high  impedance  bridge  and  does  not  have  any  ability  to  transmit  anything  onto  the 
network.  In  fact,  we  go  to  great  lengths  to  ensure  that  our  system  is  satisfactorily  isolated  from 
the  network  to  which  it  is  attached.  Also,  if  is  only  attached  to  the  network  after  consultation 
with,  and  with  the  agreement  of,  technical  personnel  from  the  ISP. 


This  leads  to  the  third  issue-that  of  ISP  cooperation.  To  my  knowledge,  we  have  never  installed 
this  system  onto  an  ISP’s  network  without  assistance  from  the  ISP’s  technical  personnel.  The 
Internet  is  a  highly  complex  and  heterogeneous  environment  in  which  to  conduct  such  operations, 
and  I  can  assure  you  that  without  the  technical  knowledge  of  the  ISP's  personnel,  it  would  be 
difficult,  if  not  impossible,  for  law  enforcement  agencies  to  successfully  implement  and  comply 
with  the  strict  language  of  an  interception  order.  The  FBI  also  depends  upon  the  ISP  personnel  to 
understand  the  protocols  and  architecture  of  their  particular  networks. 


Another  primary  consideration  for  using  this  system  is  data  integrity.  As  you  know,  Rule  901  of 
the  Federal  Rules  of  Evidence  requires  the  authentication  of  evidence  as  a  condition  of  its 
admissibility.  The  use  of  the  Carnivore  system  by  the  FBI  to  intercept  and  store  communications 
provides  lor  an  undisturbed  chain  of  custody  by  providing  a  witness  who  can  testify  to  the 
retrieval  of  the  evidence  and  the  process  by  which  it  was  recorded.  Performance  is  another  reason 
for  preferring  this  system  to  commercial  sniffers.  Unlike  commercial  software  sniffers.  Carnivore 
ts  designed  to  intercept  and  record  the  selected  communications  comprehensively,  without 
"dropped  packets." 


In  conclusion,  I  want  to  stress  that  the  FBI  does  not  conduct  interceptions,  install  and  operate  pen 
registers,  or  use  trap  &  trace  devices  without  lawful  authorization  from  a  court.  Over  the  last  five 
years  or  more,  we  have  witnessed  a  continuing,  steady  growth  in  instances  of  computer-related 
crimes,  including  traditional  crimes  and  terrorist  activities  that  have  been  planned  or  carried  out, 
in  part,  using  the  Internet,  1  he  ability  of  the  law'  enforcement  community  to  effectively 
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investigate  and  prevent  these  crimes  is,  in  part,  dependant  upon  our  ability  to  lawfully  coliect  vital 
evidence  of  wrongdoing.  As  the  Internet  becomes  more  complex,  so  do  the  challenges  placed  on 


“  ^  P“  %  COuW  “  d0  »  “"tinned  coopemtion  of  our  industry  partners 

and  innovations  such  as  the  Carnivore  software. 


'  iook  iom'ard  10  working  with  the  subcommi  ttee  staff  to  provide 


more  information  and  welcome 


your  suggestions  on  this  important  issue.  I  will  be  happy  to  answer 
have.  Thank  You. 


any  questions  that  you  may 


5/24/02  Release  -  Page  190 


OPCA-20  (i2  3-'«) 


xxxxxx 

xxxxxx 

xxxxxx 


FEDERAL  BUREAU  OF  INVESTIGATION 
FOIPA 

DELETED  PAGE  INFORMATION  SHEET 

- Psge(s)  withheld  entirely  at  this  location  in  the  file.  One  or  more  of  the  following  statements,  where  India  ted 

explain  this  deletion. 

D  Deletions  were  made  pursuant  to  the  exemptions  indicated  below  with  no  segregable  material  available  for 
release  to  vou. 


Section  552 


□  <b><l) 
O  (h)(2) 
O  (b)(3) 


□  (b)(4) 

□  (b)(5) 


O  (b)(6) 


□  (b)(7)(A) 

□  (b)(7)(B) 

□  (b)(7)(C) 

□  (b)(7)(D) 

□  (b)(7)(E) 

□  (b)(7)(F) 
O  (b)(8) 

□  (b)(9) 


Section  552a 


O  (d)(5) 

□  <jX2) 

□  (X)(  1} 
O  (k)(2) 
a  (k)(3) 
O  (k}(4) 
O  (k)(5) 
O  (k)(6) 
O  (k)(7> 


□  Information  pertained  only  to  a  third  party  with  no  reference  to  the  subject  of  your  request  or  the  subject  of  your 
request  is  listed  in  the  title  only, 

O  Documents  originated  with  another  Government  agency(ies).  These  documents  were  referred  to  that  agency  ies) 
for  review  and  direct  response  to  you, 

- -  contain  information  furnished  by  another  Government  agency  (ies),  You  will  be  advised  by  the  FBI  a 

to  the,  reteas  ability  of  this  information  following  our  consultation  with  the  other  agency(tes). 

, -  Page(s)  withheld  inasmuch  as  a  final  release  determination  has  not  been  made.  You  will  be  advised  as  to  t 

disposition  at  a  later  date. 


Pages  were  not  considered  for  release  as  they  are  duplicative  of 
Page(s)  withheld  for  the  following  reason(s); 


/¥  o&c  />&s4r 

7 . oFFtce  F> 

/^o) 


The  following  number  is  to  be  used  for  reference  regarding  these  pages: 


reference 

JjL£* 


W&£S 


xxxxxx 

xxxxxx 

xxxxxx 


xxxxxxxxxxxxxxxx 

X  Deleted  Page(s)  X 
X  No  Duplication  Fee  X 
X  for  this  page  X 

XXXXXXXXXXXXXXXX 


FBl'fOJ 


'fiv 


Alan  Davidson,  Staff  Counsel 


lofl 


vvysiwygr/O^y/v.wv.cdforgftofflc^ 


Center  for  Democracy  &  Technology 

Our  Mission  /  (let  Involved  /  Staff  /  Publications  /  Links  /  Search  COT  /  Jobs  /  Action!  July  24,  2000 


Alan  Davidson 


W 


4bd$html 


-  v-a.; 


Staff  Counsel 

abd@c<?t>Qrg  Recent  ErgssiMmas 

Alan  Davidson  is  Staff  Counsel  at  the  Center  for 
Democracy  and  Technology  (CDT),  a  Washington  D,C 
non-profit  group  working  to  promote  ci  vil  liberties  on  the 
Internet  and  other  new  digital  media.  Mr,  Davidson  is 
currently  leading  CDT*s  efforts  to  promote  encryption 
policies  that  protect  privacy  and  free  expression  m  the 
information  infrastructure.  He  has  written  and  spoken 
widely  on  the  civil  liberties  implications  of  public  policies 
that  restrict  encryption,  and  has  been  directly  involved  in 
the  ongoing  Congressional  debate  over  cryptography 
legislation.  »  r  j 

Mr.  Davidson  also  works  more  broadly  on  issues  relating  to  Internet  policy  includmo  fiw>  «««.h 
tmd  censorship,  Internet  governance,  digital  signatures  Jd  dectronic  commerce.  domain  nlSe^ 
issues,  and  online  gammg.  He  took  part  in  CDTs  coordination  of  one  of  the  tv^-o  victorious 
^ges  to,  !  Communications  Decency  Act  at  the  Supreme  Court  in  ACLU  v.  Reno  His 
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American  Cm!  Liberties  Union 


In  Unique  Tactic,  ACLU  Seeks  FBI  Computer  Code 
On  "Carnivore"  and  Other  Cybersnoop  Programs 

FOR  IMMEDIATE  RELEASE 
Friday,  July  14,  2000 

r  aU\  »  ay  be  fe/Tfet  request  of  its  Und> the  American  Civil  Liberties 
asking  tire  Federal  Bureau  oflnvestigation  to  disclose  the  computer  source  code 
and  other  technical  details  about  its  new  Internet  wiretapping  programs. 

In  a  Freedom  of  Information  Act  (FOJA)  request  sent  today  to  the  FBI  the  ACLU  is 
seeking  all  agency  records  related  to  the  government  e-mail  "cybersnoop"  programs  dubbed 
mS'data  hthfpeek’  ^eluding  "Otters,  correspondence,  tape  recordings, 

tecimiclfspSiSSns"  ’ COmputer  source  and  ob-*ect  code-  technical  manuals,  [and] 

aSP81:  "S°Un  CO,del  \s.tbe  set  ofinstmctions  for  a  program  written  by  its  creators, 
which  is  compiled  into  object  code  ’  which  can  be  read  by  machines. 

"Right  now,  the  FBI  is  running  this  software  out  of  a  black  box,"  said  Barry  Steinhardt 
Associate  Director  of  the  ACLU  and  author  of  the  letter.  "The  FBI  is  saying  ‘trust  S? we’re 
anyb°dy  S  PnVaCy  ’ With  311  due  resPect>  we<d  Hke  determine  that  for 

I^;tnwirb'^«S^n?^IedleJ  reciuef  for  program  source  code  is  the  first  of  its  kind.  But 

Stemhardt  said  that  two  federal  appeals  court  rulings  that  computer  code  is  a  form  of 

different  from  mY  othier  wntten  document,  support  the  ACLUs  demand  under 

tafo^tatuly  8i¥K  AraeriCa,S  hmi  ri*hfe  10  0bWn 

programs  is  necessary  to  determine  just  how  the  software  operates  and  whether  e-maii 
privacy  is  being  violated. 

°f  ?ese  te?hfo1?8!'os  "cry  out  for  Congressional  attention  if  we  are  to 
mem£rsofO?ngres?dmen  nghtS  ,a  dlgita!  aSe>"the  ACLU  said  in  a  July  1 1  letter  to 

Revelations  about  the  Carnivore  program  also  prompted  calls  for  disclosure  from 

LS?ScfA™^^lPftf  y‘ In  %stm™nt  “«*  * My  12,  House  Majority 
Leader  Dick  Armey  called  on  Attorney  General  Janet  Reno  and  FBI  Director  Louis  Freeh  to 

addressed^1  ^  Cyb8rSn00pmg  syst8rn  Fourth  Amendment  concerns  are  adequately 

In  addition,  the  House  Judiciaiy  Committee  Subcommittee  on  the  Constitution  has 
scheduled  a  hearing  on  the  matter  for  Monday,  July  24.  The  ACLU  has  asked  to  submit 
testimony  to  the  Committee. 

The  FBI  has  20  business  days  to  respond  to  the  FOIA  request.  The  ACLU  is  seeking  a 
response  on  an  expedited  basis,  the  letter  said,  "because  this  information  relates  to  * 
impending  policy  decisions  to  which  informed  members  of  the  public  might  contribute." 
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If  our  request  is  denied  in  whole  or  part,  we  ask  that  you  justify  all  deletions  by  reference 
to  specific  exemptions  of  the  act,”  the  ACLU  letter  concluded.  y 


The  ACLU's  letter  to  the  FBI  follows. 


July  14, 2000 

Attention: 

John  Kelso  Jr. 

Federal  Bureau  of  In  vestigation 

Chief,  FOI/PA  Section,  Rm.  6296  JEH 

Washington,  D.C.  20535-0001 

Dear  Mr.  Kelso: 

We  are  writing  pursuant  to  the  Freedom  of  Information  Act  (5  U.S.C.  Sec.  552)  to  request 

all  agency  records  including  letters,  correspondence,  tape  recordings,  notes,  data 

memoranda,  email,  computer  source  and  object  code,  technical  manuals,  technical 

the  foltowtog-  °r  ^  °ther  materials  held  b>’ the  Federai  Bureau  of  Investigation  regarding 

1 .  The  computer  system,  software  or  device  known  as  "Carni  vore”,  which  has  been  or  is 
currently  used  by  the  FBI  in  connection  with  trap  and  trace  and  pen  register  orders 
served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  interception 
ot  the  content  of  electronic  communications  served  on  Internet  Service  Providers; 

2.  The  computer  system,  software  or  device  known  as  "Omnivore”,  which  has  been  or  is 
currently  used  by  the  FBI  m  connection  with  trap  and  trace  and  pen  register  orders 
served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  interception 
or  the  content  of  electronic  communications  served  on  Internet  Service  Providers,  and 

3.  The  computer  system,  software  or  device  known  as  "EtherPeek”,  which  has  been  or  is 
currently  used  by  the  FBI  m  connection  with  trap  and  trace  and  pen  register  orders 
served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  interception 
ot  the  content  of  electronic  communications  served  on  Internet  Service  Providers. 

We  seek  a  waiver  of  fees  associated  with  the  fulfillment  of  this  request  for  all  search  and 
processing  fees,  pursuant  to  Section  552(a}(4)(A)(ii)(II)  of  the  Freedom  of  Information  Act. 


b  ~  u  ,  . r  ,  x  ui  uuunxiaiion  AC 

Records  are  not  sought  for  commercial  use,  and  as  a  representative  of  the  news  media*  the 

Aroencan  Cmi  Liberties  Foundation  (ACLU  Foundation)  qualifies  for  a  fee  waiver  wider 
this  provision  of  the  FOIA.  The  organization  meets  the  criterion  laid  out  in  Nation  al 
security  Archive  v.  Department  of  Defense,  where  a  representative  of  the  news  media  is 
defined  as  an  entity  that  "gathers  information  of  potential  interest  to  a  segment  of  the 
public"  and  "uses  its  editorial  skills  to  turn  raw  materials  into  a  distinct  work  and 
distributes  that  work  to  an  audience."  881  F,  2d  at  1387.  The  ACLU  Foundation  publishes 
newsletters,  frequent  press  releases,  news  briefings,  right  to  know  handbooks  and  other 
materials  that  are  disseminated  to  the  public.  Its  material  is  widely  available  to  everyone 
including  tax  exempt  organizations,  not-for-profit  groups,  law  students  and  faculty  for  no 
cost  or  for  a  nominal  fee  through  its  public  education  department.  The  ACLU  Foundation 
disseminates  information  through  publications  available  on-line  at  www.aclu.org  as  well. 

In  addition  we  request  a  fee  waiver  for  duplication  costs  because  disclosure  of  this 
information  is  m  the  public  interest.  It  is  likely  to  contribute  significantly  to  the  public 
understanding  of  the  activities  of  the  government  The  ACLU  Foundation  is  a  nonprofit 
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a  rese.arc^1  organization  working  to  increase  citizen  participation  in 

governance  issues.  Hie  ACLU  Foundation  is  mstino  fKic  'r&rfti&ei  ifP-.  it  ^ 


technology  and  the  rapid  gmwhoS  World  wSle  Web  SfdSnSfhf,  , 
increased  the  communications  interconnectedness  of  all  the  countries  in  die  world' 6  great  y 
especially  technologically  advanced  nations  like  the  OS  and  the  Netherlands. 

taneXS  noSlS  reVifW  ?Pm  re(3ucst  because  this  infomtation  relates  to 
unpendmg  policy  decisions  to  which  mfenned  members  of  the  public  might  contrihnfie. 
Timely  public  access  to  these  materials  is  necessary  to  fully  inform  i 

issues  surrounding  communications  interception  S^SStoSSldS^iSL- 

SDed/cevpmitWtf^f?  Whf  5®fr  F3rt>  we  ask  that  you  justify  all  deletions  by  reference  to 

5S2(a)(6)(A)(I^ t0  >0UI  rep*y  W,tlim  20  busmess  days> as  the  statute  requires  under  Section 

Thank  you  for  your  assistance. 

Sincerely, 

Bany'  Steinhardt,  Esq. 

On  behalf  of  the  ACLU  Foundation 


moot  (  KM 
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ACLU  Urges  Congress  to  Put  a  Leash  on  "Carnivore” 

And  Other  Government  Snoopware  Programs 

FOR  IMMEDIATE  RELEASE 
Wednesday,  July  12, 2000 

WASHINGTON  —  Law  enforcement  officials  using  new  surveillance  technologies  online 
are  racing  far  ahead  of  established  privacy  law  and  must  be  reined  in,  the  Amencan  Civil 
Liberties  Union  said  today. 

In  a  Msrsent  to  Charles  T ,  Canady,  R-FL,  Chair  of  the  Constitution  Subcommi  ttee  of  the 
House  Judiciary  Committee,  and  ranMng  member  Melvin  L.  Watt,  D-NC,  the  ACLU  said 
£h&l  the  unbridled  uses  of  these  technologies  f,cry  out  for  Oongressionsl  attention  if  we  etc 
to  preserve  Fourth  Amendment  rights  in  the  digital  age." 

Specifically,  the  ACLU  sharply  criticized  the  FBI's  new  online  wiretapping  program 
dubbed  "Carnivore that  uses  Internet  Sendee  Providers  (ISPs)  to  intercept  and  analyze 
huge  amounts  of  e-mail  from  suspects  and  non-suspects  alike. 

It  is  high  time  that  lawmakers  put  a  leash  on  Carnivore  and  other  government  schemes  that 
go  way  beyond  what  Congress  authorized  under  the  Electronic  Communications  Protection 
Act,"  said  Laura  W.  Murphy,  director  of  the  ACLU's  Washington  National  Office  and  an 
author  of  the  letter. 

Currently,  law-  enforcement  is  required  to  "minimize”  its  interception  of  non-incriminating 
communications  of  a  target  of  a  wiretap  order.  But  Carnivore  does  just  the  opposite, 

Murphy  said,  by  sweeping  in  e-mails  from  innocent  Internet  users  as  well  as  the  targeted 
suspect.  ,  6 

B  arry  Steiohardt,  Associ  ate  Director  of  the  ACLU  and  an  author  of  the  letter,  said  that 
implementing  Carnivore  "is  comparable  to  allowing  government  agents  to  rip  open  Post 
Office  mailbags  and  scan  every  piece  of  mail  in  search  of  one  speci  fic  letter  whose  address 
they  already  know.” 

He  also  noted  that  while  the  system  is  plugged  into  the  ISP,  it  is  controlled  solely  by  the  law 
enforcement  agency.  In  a  traditional  wiretap,  the  tap  is  physically  placed  and  maintained  by 
the  telephone  company.  J 

pe  snoopware  program  first  came  to  light  during  an  April  6  hearing  before  the  Constitution 
Subcommittee.  The  Carnivore  system  -  essentially  a  computer  running  specialized 
software-  is  attached  either  when  law  enforcement  has  a  court  order  permitting  it  to 
intercept  in  "real  time”  the  contents  of  the  elec  tronic  communications  of  a  specific 
individual,  or  a  trap-and-trace  or  pen  register  order  allowing  to  it  obtain  the  numbers  related 
to  communications  from  or  to  a  specified  target. 

But  "in  the  Internet  context,"  the  ACLU  letter  said,  “these  orders  and  certainly  Carnivore 
likely  involve  ascertaining  the  suspect's  e-mail  address,  as  well  as  header  information  that 
may  provide  information  regarding  the  content  of  the  communication." 

In  urging  Congress  to  accelerate  its  consideration  of  applying  Fourth  Amendment  principles 
in  the  digital  age,  "we  would  be  happy  to  work  with  the  Subcommittee  on  drafting 
legislation  that  protec  ts  the  privacy  rights  of  Americans,*'  the  ACLU  l  etter  said. 

> 
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the  April  6  hearing. 


plated  development,  the  ACLU  has  criticized  other  government  surveillance 
schemes,  mcludmg  a  global  electronic  surveillance  system  -  known  by  the  code  name  of 

worldwide"  **** 58  captunng  sale51lte>  microwave,  cellular  and  fiber-optic  communications 


-iijf 


The  ACLITs  letter  on  Carnivore  is  online  at;  j^//wwwtae1a.org/congressA071  I  rina  hbpf 

For  more  Information  on  the  April  6  hearing,  click 
Mp;'//ww.achi.ore/newfi/2nno/nf>4nftn()Kij1tT71j 


For  more  information  on  "Echelon," 


go  to  hUp;//w\yw, 
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July  11,2000 
VIA  FAX 

Hon.  Charles  T.  Canady,  Chairman 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg. 
Washington,  D.C.  20515-6220 


Hon.  Melvin  L.  Watt,  Ranking  Member 
Constitution  Subcommittee  of  the 
House  Judiciary  Committee 
362  Ford  House  Office  Bldg. 
Washington,  D.C.  20515-6220 


Dear  Representatives  Canady  and  Watt: 


'  — «vv,„v,*v  wAMuvimHtuj  w  ijuci^epi  ana  analyse 

huge  volumes  of  email.  The  Carnivore  system  gives  law  enforcement  email  interception 
capabilities  that  were  never  contemplated  when  Congress  passed  the  Electronic 

?0°^fS0LS  ^riva?y  Act  C^CPA),  codified  in  relevant  part  at  1 8  U.S.C.  25 1 0-22  and 
IK  UhC  3121-27.  Carnivore  raises  new  legal  issues  that  cry  out  for  Congressional  attention 
if  we  are  to  preserve  Fourth  Amendment  rights  in  the  digital  age. 

The  existence  of  Carnivore  first  came  to  light  in  the  April  6  testimony  of  Attorney  Robert 
Com-Revereto  the  Constitution  Subcommittee.  Its  operation  was  further  detailed  in  a  report 
mat  appeared  m  today's  Wall  Street  Journal  (copy  attached).  According  to  these  reports  the 
Carnivore  system  -  essentially  a  computer  running  specialized  software-  is  attached 
directly  to  an  Internet  Servi^  Provider's  (ISP)  network.  Carnivore  is  attached  either  when 
law  enforcement  has  a  Title  III  order  from  a  court  permitting  it  to  intercept  in  real  time  the 
contents  of  the  electronic  communications  of  a  specific  individual,  or  a  trap  and  trace  or  pen 
register  order  allowing  to  tt  obtain  the  "numbers"  related  to  communications  from  or  to  aP 
specified  target 

But  unlike  the  operation  of  a  traditional  a  pen  register,  trap  and  trace  device,  or  wiretap  of  a 
conventional  phone  line,  Carnivore  gives  the  FBI  access  to  all  traffic  over  the  ISP's 
network,  not  just  the  communications  to  or  from  a  particular  target.  Carnivore  which  is 
capable  of  analyzing  millions  of  messages  per  second,  purportedly  retains  only  the 

afcoert?eC*fied  tafget’ aitll0U§h  this  Process  takes  place  without  scrutiny  of  either 


Carnivore  permits  access  to  the  email  of  every  customer  of  an  ISP  and  the  email  of  every 
person  who  communicates  with  them.  Carnivore  is  roughly  equivalent  to  a  wiretap  capable 
of  accessing  the  contents  of  the  conversations  of  all  of  the  phone  company's  customers  with 
the  "assurance”  that  the  FBI  will  record  only  conversations  of  the  specified  target  This* 

'trust  us,  we  are  the  Government"  approach  is  the  antithesis  of  the  procedures  required 
under  our  the  wiretapping  laws.  They  authorize  limited  electronic  surveillance  of  the 
communications  of  specified  persons,  usually  conducted  by  means  of  specified 
communications  devices.  They  place  on  the  prorider  of  the  communications  medium  the 
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responsibility  to  separate  the  communications  of  persons  authorized  to  be  intercepted  from 
other  communications. 

Currently,  law  enforcement  is  required  to  ‘’minimize”  its  interception  of  non-incriminating 
communications  of  a  target  of  a  wiretap  order.  Carnivore  is  not  a  minimization  tool.  Instead 
Carnivore  maximizes  law  enforcement  access  to  the  communications  of  non-targets.  * 

In  his  testimony  to  yo  ur  subcommittee  Mr.  Com-Revere  described  the  experi  ence  of  his 
client,  an  ISP  that  was  required  to  install  Carnivore  when  presented  with  a  trap  and  trace 
order.  He  detailed  his  client's  concerns  that  a  trap  and  trace  order  in  the  context  of  the 
Internet  revealed  information  that  Congress  did  not  contemplate  when  it  authorized  their 
limited  use.  In  the  traditional  telephone  context,  those  orders  reveal  nothing  more  than  the 
numbers  dialed  to  or  from  a  single  telephone  line.  In  the  Internet  contex  t,  these  orders  and 
certainly  Carnivore,  likely  involve  ascertaining  the  suspect's  e-mail  address,  as  well  as 
header  information  that  may  provide  information  regarding  the  content  of  the 
communication. 

As  we  have  stated  previously,  the  ACLU  does  not  believe  that  it  is  clear  that  the 
Government  can  serve  an  order  on  an  Internet  service  provider  and  obtain  die  e-mail 
addresses  of  incoming  and  outgoing  messages  for  a  particular  subscriber.  Further,  it  is  not 
clear  whether  law  enforcement  agents  use  or  should  use  authority  under  the  pen  register 
statute  to  access  a  variety  of  data,  including  Internet  Protocol  addresses,  dialup  numbers  and 
e-mail  logs.  We  certainly  do  not  believe  that  it  is  clear  that  law  enforcement  can  install  a 
super  trap  and  trace  device  that  access  to  such  information  for  all  of  an  ISP's  subscribers. 

In  light  of  the  new  revelations  about  Carnivore,  the  ACLU  urges  the  Subcommittee  to 
accelerate  its  consideration  of  the  application  of  the  4th  Amendment  in  the  digital  age. 

Legislation  should  make  it  clear  that  law  enforcement  agents  may  not  use  devices  that  allow 
access  to  electronic  communications  involving  only  persons  other  than  a  specified  target  for 
which  it  has  a  proper  order.  Such  legislation  should  make  clear  that  a  trap  and  trace  order 
served  on  an  ISP  does  not  authorize  access  to  the  contents  of  any  communication  - 
including  the  subject  line  of  a  communication  -  and  that  the  ISP  bears  the  burden  of 

protecting  the  privacy  of  communications  to  which  FBI  access  has  not  been  granted. 

* 

We  would  be  happy  to  work  with  the  Subcommittee  on  drafting  legislation  that  protects  the 
privacy  nghts  of  Americans  . 

Sincerely, 

Laura  W.  Murphy 

Director,  ACLU  Washington  National  Office 

Baity  Steinhardt 
Associate  Director,  ACLU 

Gregory  T.  Nojeira 

Legislative  Counsel,  ACLU  Washington  National  Office 

cc:  Members  of  the  Constitution  Subcommittee  of  the  House  Judiciary  Committee 
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»  Fflfpm:  aitprivaey  .spyware 
» ISaag:  ‘Carnivore*  Wont  Devour  Cyber-Privacy 

»  Message  1 1  of  1589 

Subject:  Re:  ‘Carnivore*  Wont  Devour  Cyber-Privacy 

Date:  07/22/2000 

Author:  huskv  <cbminfo@dioitai.ne«» 

<<  previous  in  search  •  next  in  search  » 
Message  segment  2  of  2  -  Oat  Previous  Segment .  Get  AH  2  ikj; 

if  you  give  up  your  persona!  privacy,  every  other  freedom  will  follow  shortiy.  Though  for  my  • 
bucks. !  say  let  carnivore  loose.  Whether  carnivore  does  it’s'fob  or  not  has  littie  todoS?'1' 
whether  or  not  your  health  or  credit  records  are  safe.  If  youVe  posted  your  credit  card  l^ere 

^Fixing  the  relationship  between  Washington  and  Silicon  Va^n^sto;  ^*v^^>?^'v 
J«top  priority  for  the  next  administration.  The  only  peopte  benefiting'  ’ :  '*• 

>  controversies  like  the  one  over  Carnivore  are  terrorists,  criminals  and : 

>  rogue  states.  -  ; 

SX^SgSS&ssts:  m  a“™  t  «•  *rr  ?’****• 

Carnivore  Is  just  the  current  subject  under  scrutiny.'  v  ' v 

«  previous  in  search  -  next  tn  search  » 
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»  Esass:  sit.comp.fraew3re 
v>  IfefltM:  British  law  would  allow  police  to  intercept  e-mail 

»  Message  2  of  1589 

Subject:  Re:  British  law  would  allow  police  to  Intercept  e-mail 
Date:  07/24/2000 

A°thon  TallesinS  <3liesin2@eattMink.net> 
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**  previous  in  search  -  next  in  search » 
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URGENT  ACTION  ITEM!  Congress  agrees  to  hold 

hearing  on  Monday  in  response  to  public  outrage 

over  FBI's  e-mail  spy  scheme  .  ;  .•  ;.  . 


You  are  receiving  this  alert  because  you  participated  in 
DefenOYourPdvacy.com^  successful  1999  campaign  against  the 
FDiC‘s  proposed  Know  Your  Customer  bank  spying  regulation,  if 
you  do  not  want  to  receive  further  updates,  please  use  the 
unsubscribe  directions  at  the  end  of  this  message. 
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*  Immediate  action  required:  Help  us  Kill  the  Vk  =’  ■  ..  ■■  . 

Carnivore!  -  'r'-. 

On  July  14  we  issued  a  press  release  about  an  FBI  cybersnooplng  device  axie-named 
Carnivore,  which  can  scan  millions  of  e-mails  per  second.  Because  Carnivore  has  unlimited 
ppwer  to  spy  on  almost  everyone  with  an  e-mail  account,  it  may,  bp  the  biggest  threat  to  your 

privacy  ever.- '  _  :  •,  '  *>t'  >vj-;  '■ 


.  ,  ....  - ---  — * — I  was  disclosed  in  3  July  11  Wall  Street  >■ ; 

Journal  article,  public  outrage  began  to  mounts  iand  now  Congress  has  beak  breSsured  ihib^ 
holding  hearings  bn  Carnivore. aWS*4**4'*'  ’  ‘  ■* r-  '  


"To  csmifatim  no  klnfvXai/*  u,it-a  i.. .7- 
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developed  at  its  lab  in  Quantise,  Va.  Dubbed  Carnivore  because,  of  its  ability  to  find  *the  meat*1 
emong  miitions  of  e-mails.  Carnivore  scans  evbiy  incoming  arid  pdtebing  e^niafl  message  on  a 
network  looking  for  tditale  wbriJs  or  names,  and  sives  thos^tribssages  for  later  retrieval  by 
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law  enforcement  Cai 
relay  sessional 


The  FBI  admits  that  Carnivore will  scan  millions  of  e-mail  5-'* 

finds  ^y.nui^b^,of.me^a9e$from  people  suspeded  of  crimes  Jfhafs  m  0mniSmt^ 

FBI  opened  evervone^  mail  hooino  to  find  &  'tatter  fmm  »  r\r  ttcforvcari  Jen  An  XH>Aft>AnAV 


Though  Carnivore’s  existence  was  fust  publicly  revealed,  the  FBI  has  already 

device  at  dozens  of  Internet  Service  Providers  (ISPs)  around  .the  country,:  and  claims  It  Ms  >fe: 

used  K  *fewer  than  5D  times*  so  for.  In  m anv  oa fh*  Fftf  fcAAn«s  th*  a  wia/t 


on  the  l: 
retrieve 


Many  isps  have  refused  to  allow  the  FBI  to  install  Carnivore,  citing  concerns  .tfiat ’the  privjaqy* 
of  a>  X  .  customers  could  be  violated.  But  earlier  this  year,  a  federal  judge  ruled  against  brie 
such  ISP*  leaving  It  no  choice  but  to  allow  the  FBI  aortas  tri  ft*  $ 


Predictably*  the  F8i  promises  to  limit  surveillance  to  messages  froin  suspected  habkets;/  ..; 
terrorists,  pr  dnig  driers.  But  considering  that  this  is  the  same  agency  that  quietly  Inserted : 
roving  telephone  tap*  authority  into  federal  law  and  Illegally  turned  over  confidential  personnel 
files  to  the  piinton  .Vyhite  House*  you  shouidnl  be  expected  to  trust  It  with  your<^rifidentiaf  V  ^  . 
e-mails; :  :-v  ;•■>. ■  ';•••  ?v;  •;  v':;v ; .  .  ■•  •;  "JV 

But  Carnivore  is  more  than  a  threat  to  your  ordinary  e-mail 

correspondence  -  It  also  gives  government  bureaucrats  the  ability  to  spy  on  your  ohfine 
banking  transactions*  because  It  has  the  ability  to  monitor  all  digital  communications;  Th© 
bottom  line  is  that  your  privacy  won't  be  protected  as  long  as  Carnivore  Is  on  the  loose. 
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Telecoms  Miffed  at  FBI  Meddling 

fay  Oeelan  Mccu»»?fr 

3:00  a.m.  Jyf,  8,  2000  POT 

t?de  fssoci3tion  this  week  criticized  a  recent  FBI  move  to  thwart  the  $S  5 
billion  sale  of  ISP  Vsno  to  a  Japanese  firm,  * 

The  FBI's  obigptiops  that  the  Fed  agency  may  not  be  able  to  conduct  the  kind  of  Internet 
surveillance  it  desires  are  specious,  said  the  Computer  and  Communications  Industry  Association, 


Everybody’s  got  issues  in  Politic^ 


“In  taking  this  action  the  FBI  runs  the  serious  risk  of  frustrating  the  openness  of  Internet 
communications  infringing  our  civil  liberties,  and  damaging  our  relations  with  important  trading 
^>S?i S3id  B  ack'  President  of  the  CCIA.  The  groups’  members  include  AT&T,  Norte!  Nokia 
and  NTT  America,  the  Japanese  company  which  hopes  to  purchase  Verio. 

Last  £®af' the  FBI  MQsypcessfu|iy_sskgd  the  Internet  Engineering  Task  Force  to  build  wiretap 
capabilities  into  protocols,  FBI  Director  Louis  Freeh  has,  in  the  past,  asked  Congress  for  domestic 
controls  on  date-scrambling  encryption  products  and  successfully  pressed  for  a  "digital  telephony" 
Feds  ^ ^  requires  telephone  companies  to  ensure  that  their  networks  are  able  to  be  tapped  by  the 

Anti-anonymity;  If  you  criticize  a  Pennsylvania  judge  online,  be  warned:  You  may  not  be  as 
anonymous  as  you  thought  y  e  db 

Thin-skinned  Superior  Court  Judge  Joan  Orie  Melvin  In  early  1999  sued  over  a  dozen  “John  Does" 
that  she  suspected  of  posting  messages  on  a  muckraking  site  devoted  to  Pittsburgh  politics, 

A  judge  who  recently  heard  arguments  in  Melvin’s  case  will  decide  whether  or  not  to  unmask  the 
folks  who  particpated  in  the  “Grant  Street  99"  site,  according  to  an  article  in  the  Pittsburgh 

*  *  *  v  AvflCfi 

I^Ln^UJSc-defenf:ln9  the  Jfhn.?feS/  indudin3  one  wh<3  reportedly  alleged  that  Judge  Melvin  was 
engaged  in  surreptitious  and  --  if  true  —  unlawful  partisan  political  activity* 

Bill  Joy  a  Killjoy?  An  article  on  the  website  of  the  conservative  National  Review  takes  aim  at  Bill 
Joy  of  Sun  Microsystems,  who  recently  raised  eyebrows  when  he  warned  of  the  dancers  of 
unregulated  technology.  9ereof 

Authors  Glenn  Reynolds  and  Dave  Kopel  said  Joy’s  article,  published  earlier  this  year  in  Wired 
Magazine,  is  an  example  of  "neo-luddite  sentiment." 

"More  generally,  Luddite  intellectuals  are  successfully  propagating  ’the  precautionary  principle  ’ 
which  states  that  we  should  never  try  anything  new  unless  we  are  certain  that  ft  is  absolutely* 
safe...  Even  worse,  ’’relinquishment"  would  probably  accelerate  the  progress  of  destructive 
nanotechnology.  In  a  world  where  nanotechnology  is  outlawed,  outlaws  would  have  an  additional 
incentive  to  develop  nanotechnology,"  the  National  Review  authors  wrote. 

Upcoming  events;  Two  U.S.  senators  are  holding  a  briefing  on  medical  and  genetic  privacy  on 
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July  14.  The  event,  sponsored  by  the  Forum,  on  Technology  Innovation  is  scheduled  for  12:15  p.m. 
in  room  325  of  the  Russell  Senate  office  building...  The  Freedom  Forum  is  releasing  its  state  of  the 
First  Amendment  survey  on  3uly  13  at  9  am,.,  A  federal  online  "chi id  protection"  commission  meets 
3uly  20  in  Richmond. 
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FBI  taps  of  e-mail  provoke  concerns 

Privacy  issues  lead  to  House  hearings  on  ‘Carnivore’  work;  Name  called 
'unfortunate' 


By  Del  Quentin  Wilber 
Sun  National  Staff 


its  name;  "Carnivore. 


ominous  as 


Attached  to  an  ISP's  server,  the  contraption  sifts  through  countless  e-mail 
messages  and  copies  specific  information  for  federal  agents  seeking 
suspected  criminals,  including  terrorists  and  child  pomographers. 

But  critics  say  that,  in  the  process  of  sifting  out  communications  from  its 
targets,  Carnivore  is  also  capable  of  retrieving  the  private  messages  of 
innocent  people.  ° 

"This  is  a  very  dangerous  device,"  said  Barry  Steinhardt,  associate  director  of 
the  American  Civil  Liberties  Union.  "It's  unprecedented.  It's  the  first  time 
law  enforcement  has  carte  blanche  access  to  the  entire  service  provider’s 
network.”  * 

The  controversy  surrounding  the  device  with  the  foreboding  name  has  caught 
the  attention  of  Republican  lawmakers,  and  a  House  Judiciary  subcommittee 
is  scheduled  to  hold  a  hearing  on  the  matter  today.  Opponents  and  authorities 
who  support  the  use  of  Carnivore  are  scheduled  to  testify. 

After  the  system  was  disclosed  in  recent  news  accounts,  sparking  criticism 
nom  privacy  advocates,  FBI  officials  met  with  lawmakers  and  reporters  to 
try  to  show  that  Carnivore  is  not  nearly  as  intrusive  as  some  fear* 

For  one  thing,  FBI  officials  said,  they  need  the  device  to  combat  crime  and 
threats  to  nationaUecurity.  They  describe  Carnivore  as  a  "surgical”  tool  that 
would  protect  ordinary  people  from  unintended  searches. 

"There  are  filtering  mechanisms  built  in  that  limit  the  amount  of  information 
viewable  to  the  human  eye,"  said  Paul  Bresson,  a  spokesman  for  the  bureau. 

It  ensures  that  only  the  exact  commimi cations  authorized  by  a  court  are 
what  we  intercept” 

For  decades,  federal  agents  and  local  police  have  been  wiretapping  suspects' 
phones  after  obtaining  permission  from  judges.  But  those  wiretaps  are 
limited  to  a  specific  suspect  and  do  not  comb  through  phone  calls  at  random. 

Carnivore  works  much  differently,  though  authorities  still  must  obtain 
permission  from  a  judge  to  scour  e-mail  messages  or  discover  which  Web 
pages  a  suspect  visits. 


Once  they  have  court  approval,  agents  attach  the  Carnivore  device  - 


an 


5/24/02  Release  -  Past  285 
7/24/00 11:34  AM 


Su&Spot  -  hBI  taps  of  e-mail  provoke  tv..  >.ems 


http://v,'sw,suiispo(.net/cgi-u_^e<i!..,mnbl“Ktews&breac!crumb2-Na 


ordinal-looking  desktop  computer  -  to  the  ISP's  main  computer,  and 
Carnivore  passively  sniffs  through  streams  of  data,  FBI  officials  said. 

£^S°r?  d°e\n0t  read  e*mad  messa£es  or  the*r  subject  lines,  officials  said. 
Instead,  it  searches  for  computer  codes  that  direct  the  message  to  and  from 
the  suspect.  Nor  can  it  scan  e-mail  messages  for  key  words,  like  "drugs  or 
oomo,  an  FBI  official  said. 

aut^^ties  say.  Carnivore  acts  like  an  FBI  agent  authorized  to 
scan  envelopes  sent  by  mail.  The  agent  seeks  a  particular  suspect's 
addressing  information  and  pulls  aside  any  qualified  envelope  and  opens  it 

Last  week,  after  an  outcry  from  critics,  the  White  House  said  it  would 
propose  legislation  to  among  other  things,  require  agents  to  seek  Justice 
Department  clearance  before  asking  judges  to  authorize  the  use  of  Carnivore 
in  a  specific  case.  Such  rules  already  cover  voice  wiretaps. 

But  the  proposal  was  dismissed  by  civil  liberties  groups,  who  said  it  did  not 
go  tar  enough  in  protecting  electronic  communication. 

For  their  part,  FBI  officials  say,  the  White  House  proposal  is  not  necessary; 
They  say  they  abide  by  the  rules  governing  voice  wiretaps  to  use  Carnivore. 

Despite  the  assurances  of  FBI  officials,  civil  liberties  groups  and 
congressional  Republicans  say  they  are  war}'  of  the  system. 

?  «aS  capacity  of  grabbing  it  all,"  said  Richard  Diamond,  a  spokesman 
for  Rep.  Dick  Armey,  the  Texas  Republican  who  is  the  House  majority 
leader  and  a  sharp  critic  of  Carnivore.  "It  all  depends  on  who  pushes  the 

bmton.  Someone  could  push  the  wrong  button  and  have  access  to  all  sorts  of 
information."  v 

FBI  officials  dispute  that  assertion,  though  they  concede  that  Carnivore  has 
sometimes  captured  e-mail  messages  and  data  that  were  not  targeted  in  their 
searches.  They  say  they  sealed  such  information  and  did  not  read  it. 

Earlier  this  year,  an  ISP  tried  unsuccessfully  to  prevent  FBI  agents  from 

cSil!r  ,g  C?™re  anits  network.  After  a  brief  court  fight,  the  company, 
Earthlink,  yielded  to  FBI  demands  and  helped  install  die  device.  ^ 

FBI  officials  say  they  don't  mind  simply  asking  ISPs  to  provide  them  with 
e-mai!  sent  by  criminal  suspects  if  that  is  possible.  But,  m  most  cases,  agents 
would  rather  use  Carnivore  because  it  helps  maintain  security  for  criminal 
evidence.  And  many  smaller  ISPs  are  not  capable  of  creatine  urograms  to 
obtain  the  necessary  data,  FBI  officials  said.  ® 

Though  most  ISPs  have  complied  with  court  orders  to  install  Carnivore  one 
major  provider  said  it  would  refuse.  1 

"Wehe  not  going  to  stand  for  this,"  said  William  L,  Schrader,  chairman  and 
chief  executive  officer  of  PSINet  Inc.  "It's  insidious.  If  they  were  to  ask  us 
with  a  court  order  to  violate  the  privacy  of  all  our  customers  we  would  take 
this  to  the  Supreme  Court." 
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Authorities  say  that  more  criminals,  especially  those  involved  in  child 
comm^cnmeT^  ^3U^’ are  ^Rcreastngly  using  die  Internet  and  e-mail  to 

About  three  years  ago,  agents  and  federal  prosecutors  began  asking  for 

I!a]'!Lme  acceSS  t0  e.‘”?aU  md  Web-site  visits,  FBI  officials  said.  Ae  agents 
said  they  were  worried  about  not  having  reliable  and  up-to-date  intelligence. 

FBI  technicians  began  developing  Carnivore,  which  was  used  for  the  first 
Snl  n  m°u  aJ°* *uthorities  ™  officials  declined  to  disclose 

-rehted  cas“ but  saw  *•  ^tem 

ScuSoSoRwm^m  IM1re",  fT6-  °f  a  na?,e  tafag  internal 

discussions  of  the  program.  At  first,  technicians  called  it  "Omnivore"  because 

frlfft  S5ght' But  ?  ?e  SySf™  becamemore  refined,  technicians 

felt  it  needed  a  better  name  and  changed  it  to  Carnivore:  a  meat-eater. 

"We’relooking  at  how  we  name  a  lot  of  projects  right  now,"  an  FBI  official 
said.  This  has  been  sobering.” 

FBI  agents  noted  that  they  don't  need  Carnivore  to  read  most  old  e-mail 
messages  stored  on  ISP  servers;  they  can  already  do  so  with  court  approval. 

They  described  the  Carnivore  system  as  a  last-resort  measure  to  capture 
real-time  communications.  * 

Authorities  on  technology  and  society  say  they  are  hardly  surprised  that  the 
system  has  generated  anxiety,  because  many  people  now'  send  more  personal 

information  over  e-mail  than  over  the  phone.  ^  V 

Corporate  snooping  of  employee  e-mail  and  the  unauthorized  sale  of  client 
information  by  e-retailers  have  unnerved  many  computer  users. 

Originally  published  Jut  24  2000 
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FBI:  ’Carnivore'  will  play  nice 

During  demonstration,  details  of  e-mail  ’wiretap*  system  emerge 

WASHINGTON  (Bloomberg)  —  The  FBI's  Carnivore  e-mail 
surveillance  system  won't  snoop  on  innocent  Internet  users,  officials 
said  Friday, 
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FBI  officials  gave  reporters  a 
demons  tration  of  the  system  they 
say  adopts  traditional  telephone 
wiretap  methods  to  the  Internet 
without  violating  the  rights  of 
law-abiding  Web  surfers. 


The  disclosure  that  the  FBI  and 
Internet  service  providers  have 
cooperated  to  bug  the  messages 
of  criminal  suspects  has  generated  cri  ticism  from  civil  liberties  groups 
and  some  Republican  lawmakers.  They  say  Carnivore  will  let  the  FBI 
see  e-mails  oi  all  Internet  subscribers,  not  just  the  few  suspects  the  FBI 
wants  to  track.  ,  r 

FBI  officials  will  defend  Carnivore  Monday  before  a  U.S.  House 
Judiciary'  subcommittee  headed  by  Republican  Henry  Hyde  of  Illinois, 

Earlier  this  week,  the  Clinton  administration  proposed  limiting  law 
enforcement  wiretapping  of  e-mail  to  investigations  of  serious  crimes 
and  requiring  top-level  Justice  Department  authorization  of  e-mail 
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bugging.  Under  proposed  legislation,  die  procedures  for  e-mail 
surveillance  would  be  similar  to  those  in  place  for  telephone 
surveillance. 
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Watts:  FBI’s  ‘Carnivore’  System 
a  Dangerous  Invasion  of  Privacy 

Calls  on  Clinton-Gore  Administration  to  Suspend  New  Surveillance  Program 

W  AS  HINGTON  -  Rep.  J.C.  Watts,  Jr.  (R-OK  ),  Chairman  of  the  House  Republican  Conference 
and  House  Republican  Cyber-Security  Team,  issued  the  following  statement  today  on  the  FBI’s 
“Carnivore'’  system  at  a  Capitol  Hill  hearing; 

“We  need  innovative,  new  law  enforcement  strategies  to  combat  the  real  and  growing  threat  of 
cyber-crime.  U.S.  law  enforcement  needs  to  focus  resources  on  the  training  and  expertise 
necessary'  to  protect  our  cyber-security,  1  remain  committed  to  working  in  Congress  to 
adequately  invest  in  and  support  the  right  law  enforcement  tactics. 

“However,  the  FBI’s  ‘Carnivore’  program  represents  a  dangerous  and  unprecedented  invasion  of 
online  privacy.  Despite  repeated  inquiries,  the  Clinton-Gore  Administration  continues  to  offer 
only  vague  responses  and  little  enlightenment. 

The  FBI  s  record  on  protecting  privacy  is  also  problematic.  From  unwarranted  wiretaps  to  its 
mishandling  oi  hundreds  of  files  on  political  appointees  just  a  lew  years  ago,  there  is  ample 
cause  for  concern. 

“Before  we  impose  privacy  restrictions  on  the  commercial  industry,  it  seems  the  federal 
government  has  a  duty  and  an  obligat  ion  to  honor  the  privacy  of  the  people  it  has  sworn  to 
protect.  I  commend  Chairman  Canady  for  highlighting  this  egregious  threat  to  the  online  privacy 
of  every  American  .” 
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u<tn  frUSfoKO  <sf  such  Co4«  1$ 

oy  inserting  "fth*  toe  of  the 
m*t\<  af  the  American  Tcsttsportoiaft  R*ccv. 
try  Act  of  IOCS,  in  the  casc  cf  fuel'}" 
afttfr  "October  i,  both  pUoet  it  ap- 

pftaCSr, 

m  fey  insming  -{the  to*  which  if  S 


able  for  San  Luis  Unit  districts  to  ofe-  for  an  order  permitting  the  trace  (not 
tain  as  large  a  supplemental  supply  as  to  mention  having  to  approach  each 


they  would  Uxe. 

Mr.  President,  this  bill  has  already 
passed  the  House  as  H.R.  3077,  U  wiU 
impose  no  additional  roses  on  the  fed- 


provider  along  the  my).  In  the  recenc 
Denial  of  Sendee  attacks,  hackers  utL 
heed  dozens  or  even  hundreds  of 
hie"  computers  from  which  the  attacks 


fjS)  fey  inserting  «{th*  tor  which  u  S  ^  government*  It  contains  provisions  on  specific  sites  were  then  launched, 
months  after  eh*  date  of  rh*  enactment  of  which  assure  that  the  additional  water  No  doubt,  these  computers  were  \c* 
such  Act.  in  the  case  af  diesel  fuel}  after  obtained  by  districts  in  the  San  Luis  cac&d  oil  over  the  country,  and  tracing 
"March  if,  WS"  both  places  ft  appears,  and  Unit  cannot  be  used  in  a  manner  that  them  quickly  under  current  law"  i5 

wwld  exacerbate  current  groundwater  13 


mentb*  after  the  do  to  of  the  tnacSenc  of  7,  uweiore  vtmmiy  impossible, 

such  Act.  in  the  case  of  VJTS  ^  ** im &  &  *  amtem  This  legislation  w ifi  amend  current 

'-January  it  aoT,  with  the  provisions  in  the  Central  V&L  law  to  authorise  the  issuance  of  a  sin* 

(0  Saecten  *4Z?mm  af  such  Code  H  *ro«tf*  **¥  Project  Improvement  Act  that  «te  order  to  completely  trace  an  online 
ed  by  forcing  ''(during  Che  t  year  period  &*-  sought  to  encourage  the  cxdumg*  of  communication  to  ics  source,  regard* 
gtnntng  or*  the  da?*  of  the  ease tment  of  <h»  water  fey  willing  sellers  to  provide  ad-  less  of  how  many  intermediate  sites  It 
American  Transportation  Recovery  Act  of  ditfcmal  supplies  at  reaso cable  cost  to  passes  through.  Law  enforcement  must 
°*  ******  **lT*&«r  "$tp-  willing  buyers.  I  urge  the  Senate  to  still  meet  the  exact  same  burden  to  ©b- 
(c)  effective  b*TSL—  theism  tain  such  an  order;  the  only  difference 
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od  ore  equal  to  or  less  thso  such  casta  were  provisions  relating  to  fraud  and  related 
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#,  ;  A  **  in  a  different  Jurisdiction. 

United  States  Code,  to  modify  authors*  One  deficiency  of  the  Computer 
ties  relating  to  the  use  of  pen  registers  Fraud  and  Abuse  Act.  U  U.C.C.  $  ID3D  is 
and  trap  and  tract  devices,  to  modify  im  requirement  of  proof  of  damages  in 
provisions  relating  to  fraud  and  related  excess  of  ism  Jo  several  cases,  pros- 
activities  in  connection  with  com-  scucors  have .  found  that  while  com¬ 
puters.  and  for  other  purposes:  to  the  purer  intruders  had  attempted  to  harm 
Committee  on  the  Judiciary.  computers  vital  to  our  critical  infra- 

hick  tece  tKEwE  beu.  structures,  such  ss  telecommuni- 

Mr .  SCHUMHS.  Mfn  Ffcsidtut.  I  rise  cations  and  fJmsoclal  services-  damages 
today  to  introduce  with  my  friend  from  of  3S,000  could  not  fee  proven.  Novcrthe- 

4  ,a - *  £*  ^  UL.  1  .  .  .  b  «  *  . 


t>.  2531.  A  bill  to  amend  the  Act  that  Arksna,  Senator  KVL  a  high  tech  less,  these  Incrusiom  pose  a  great  risk 
authorized  CCn&Zmrtinn  af  t-rim*  hm  a imftd 


authorized  construction  of  the  San  crime  bill  aimed  at  combating  com- 
Luis  Unit  of  the  Central  Valley  puter  crime.  For  the  past  nine  months 
Project,  California*  to  SaciUtste  water  I  have  been  discussing  with  law  en* 
transfers  in  the  Central  Valley  Project;  forcement  and  computer  crime  experts 
to  the  Committee  on  Energy  and  Nat-  how  host  ro  address  the  growing  threat 


crime  bill  aimed  at  combating  com-  of  harm  to  our  country  and  must  fee 
puter  crime.  For  the  past  nine  months  prosecuted,  punished,  and  deterred, 

I  have  been  discussing  with  law  en*  The  5dmmer-Xyi  bill  will  upambig* 
forcement  and  computar  crime  experts  uously  permit  -  federal  judjsdictlon  at 
.  _  how  hast  ro  address  the  growing  threat  the  outset  of  an  unauthodzed  intrusion 

oral  Resources*  that  computer  edmes  pose  to  our  in-  into  critical  lafrastrutture  sy$t^irc> 

tm  const mcnm  cr  the  San  tes  untt  of  ortaslngly  networked  society,  rather  than  having  investigators  wait 

the  central  valley  fpoiccts  Many  of  the  best  solutions  are  far-  for  qny  damage  assessmenc.  Crimes 

Mrs.  FEIN  STEIN.  Mr,  President,  reaching  and  complex  and  will  only  fea  that  exceed  the  SS.OOO  limit  will  fee 
today  I  introduce  a  biU  to  amend  the  achieved  through  sustained  and  prosecuted  as  felonies,  while  crimes 
legislation  that  authorised  construe-  thoughtful  hard  work  on  a*  Inter-  below  that  amount  will  be  defined  as 
ticn  of  the  San  Luis  Unit  of  the  Cen-  national  level  by  both  government  and  misdemeanors.  The  bill  will  also  dar¬ 
tre!  Valley  Project  In  California.  En*  the  private  sector  in  the  years  ahead,  tfy  that  a  $5,000  loss  resulting  from  a 
actmenc  of  this  bill  would  allow  water  There  ore.  However*  modes  changes  to  computer  attack  may  include  the  costs 
districts  in  the  San  Luis  Unit  of  the  existing  laws  that  can  be  made  now,  of  res  pending  to  the  offense,  con- 
Centra l  Valley  Project  to  supplement  which  will  serve  as  a  significant  first  ducting  s  damage  assessment,  rcstor- 
thoir  federal  water  supplies  with  pur-  step  in  a  much- needed  effort  to  give  Ing  a  to  its  original  condition, 

chases  of  water  from  the  State  Water  law  enforcement  to  tools  they  need  to  and  any  lost  revenue  or  costs  Incurred 


Project,  Ac  present,  federal  law  pro¬ 
hibits  the  delivery  of  non*federal  water 
to  districts  In  the  $an  Luis  Unit  until 
certain  conditions  are  met. 

The  San  Luis  Unit  is  the  last  compo¬ 
nent  treated  by  federal  law  In  the  Cen¬ 
tro!  Valley  Project,  which  is  tbs  iarg« 
—  purtau  Racisms ^cn  preset  in 
the  United  Scares.  Water  service  to  dis¬ 
tricts  in  the  San  Luis  Unit  is  often  cur¬ 
tailed  because  of  Umtetlons  imposed 
in  pumping  In  the  Sacramento- San 
Joaquin  Delta, 

It  is  customary  for  water  districts  in 
the  San  Luts  Unit  to  supplement  their 
sue  piles  through  purchases  on  the  open 
market.  However,  current  federal  law 
promotes  them  from  purchasing  rup~ 


effectively  fight  cyber  crime.  The  legls- 
iadon  that  Senator  XYt  and  I  are  in- 


as  a  result  of  an  interruption  in  serv- 
ice.  The  SLtQO  requirement  should  not 


traducing  today  will  among  other  serve  as  a  barrier  to  the  prosecution  of 
things,  make  the  following  changes  to  serious  computer  criminals  who  threat- 


existing  law. 

Wc  must  update  our  lm$  governing 
the  use  of  what  are  called  pen  registers 
{which  record  the  numbers  dialed  on  a 
phone  line}  and  crap  and  trace  devices 
(which  capture  Incoming  ciecxrcmc  inv¬ 


ert  our  country's  networks. 

This  legislation  wiU  also  modify  a  di¬ 
rective  to  the  sentencing  commission 
contained  In  the  Anti  terrorism  ond  Ef¬ 
fective  Death  Ftnaity  Act  of  I  SSL 
which  required  a  mandatory  minimum 


pulses  that  Identify  Lhe  originating  sentence  of  six  months'  imprisonment 
number},  TheSa  laws  have  become  cut-  for  ceitoin  vioUtlcns  of  section  1030, 
dated  and  their  procedures  are  too  slow  Computer  Intrusions  that  violate  the 


for  the  speed  of  criminals  online. 

Under  currant  law,  investigators 
must  obtain  a  trap  and  trace  order  in 
each  jurisdiction  though  which  an 
electronic  communication  is  made. 


from  the  State  Water  Project  and  Thus*  for  example,  to  croc 


having  these  delivered  over  federal  fa-  communication  becwecn  two  terrorists 
cillttes.  Making  such  deL varies  is  rel*  that  starts  at  a  computer  in  Mew  York, 
ativ^iy  Because  state  and  Tedtral  goes  through  a  server  in  New  Jersey* 
project  conveyance  facilities  are  inter-  bounces  off  a  computer  in  Witcomin. 
trr.r.ectod.  Prohibiting  purchase  .  of  and  then  ends  ;n  Son  Francisco.  ;nv«s- 


conveyance  facilities  are  inter-  bounces  off  a  computer  in  Wise 
:ed.  Prohibiting  purchase  .  of  and  then  ends  ;n  Son  Francisco. 


tax*  water  for  deliver/  over  federal  fa- 
ilitirs  Hroits  the  oppcrtunities  avaib 


tl  go  tors  may  ?e 
ojveiv  to  a  court 


to  lucres- 


statute  vary  in  their  severity  or,d  maJ  I- 
eiousne&s.  All  violations  should  be  pun¬ 
ished.  but  under  the  current  regime  the 
mandatory  imprisonment  applies  to 
some  misdemeanor  charges,  even  wh*r» 
the  attack  caused  no  damoge.  As  c  re- 
suk>  some  prosecutors  have  declined  to 
bring  cases,  knowing  x hot  the  result 
would  be  monastery  imprisonment.  Ws 
sheuid  insure  that  federal  prerocutert 
are  bringing  coxes  under  section  !3TJ 
but  we  also  should  insure  that  the  sen¬ 
tences  feemg  me:?s  cut  fit  the  crime. 
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nost  technologically  savvy  our  notion,  and  4vsry  federal  dollar  al-  Mr.  President*  since  I  came  to  the 
^  are  juvenile*  who  have  located  for  Improving  this  situation  Senate  In  IS83*  I've  worked  hard  to 
t«?  With  computers  always  at  should  fee  directed  to  our  nation's  In-  mote  economic  development  and  create 
-*r  nngeraps.  unfortunately,  certain  dian  mr/3 itinns.  The  lack  of  adequate  n*w  *06$  for  my  sxace  of  Hew  Mexico 
venues  are  committing  the  most  se-  roads  and  bridges  is  *  chronic  prodlem  One  'thing  I  learned  very  «rickiv  •< 

yUS  Computer  crimes  an &  wre^kim?  an  Indian  r^AnuaHnn*  whef*  *.«.„*  **.*■<„  _ _ 


ficus  computer  crimes  and  wreaking 
havoc  on  our  critical  infrastructures. 
For  example*  one  juvenile  hacker 
caused  an  airport  in  Worcester*  Massa¬ 
chusetts  to  shut  down  for  over  six 
hours  when  its  telecommunications 
conn«cticn$  we«  brought  down.  Simi 


on  Indian  r«wv«dM$.  wh*r*  unem-  that  you ‘can't  expect  to^attr^ct^new 

peffe,ft,t  *?.*"**  indus«y  «nUss  you  have  the  basic  to. 
than  half  of  American  Indian  live  in  restructure  to  support  residential  ard 
hard  poverty.  commercial  needs.  The  moat 

Smce  iSal  when  my  Senate  amend*  infrastructure  torW* 

moot  sdded  Indian  roads  to  our  federal  r&titsn  ...  uoe  transpor- 

-  -  *  - -  w  wygm,  highway  trust  fund  accounts*  all  funds  sewer* 

tarlyt  two  California  teenagers  broke  allocated  for  Indian  roads  ha^t  been  jces  ar  jtffWaM* 

Into  sensitive  military  computers*  In*  used  for  that  purpose.  In  I5TEA.  which  to  create  oood  fobs  jW 

eluding  those  at  Lawrence  Uvermore  preceded  the  tn&ctrnenz  of  the  Toma-  vekjn  ®  *  bs  will  simply  not  de- 

National  Laboratory  and  the  U.$.  Air  p*rration  EftJcieoey  Act  for  the  2lst  ~  “ 
rcfcev,  Century  CTEA~20«  the  Indian  Reserve- 

As  a  ACnger  term  strategy*  w*  oeod  m  tion  Hoads  (IRR}  program  reached  & 
s  a  better  iob  of  u.^i  Ar  ««si  *'■* 


Today  our  country  is  fortunate  to 
have  one  of  the  strongest  economies  in 
history.  Our  recent  advances  in  job  cro* 


m  a  better  job  of  teaching  our  children  level  of  ?lSi  million  per  year*  atioo  and  -  u  * - 

from  a  very  young  age  that*  like  Any.  Many  of  us  in  Congress  worked  hard  Dti3hrn__  ivi  *?0W$  *rc  **cor*: 

where  else,  certain  conduct  on  the  so  Increase  this  IRR  funding  to  $225  E  U  should 

Internet  is  wrong  and  OlegaL  But  we  million  in  the  first  y*ar  of  TEA-21  (FY  ^  ;  Unfortunately*  as  many  of 

**°  need  to  sand  a  clear  message  that  W.  and  *27S  minion  each  year  there-  \St?y.of  <***  r?tlaA 

crimes  on  the  Internet  will  have  real  after*  through  FY  2003.  Unfortunately*  *  °  Us,  *»**  of  *c0' 

consequences*  This  legislation  will  a  little  noticed  provision  for  Federal  ^  Ptospeci^  that  has  swept  the 
amend  IS  USX.  §1030  to  give  federal  Lands  Highways,  placing  an  “cbliga*  ^  f?  particular.  I  remain  con* 
low  enforcement  Authorities  the  power  tion  limitation"  on  the  IRR  program* 

has  resulted  in  the  transfer  of  funds  in¬ 
tended  for  Indian  reservations- to  be 
transferred  to  the  SO  states* 


to  investigate  and  prosecute  juvenile 
offenders  of  computer  crimes  in  appro, 
priate  cases*  The  bill  wifi  make  juve- 
nUes  fifteen  years  of  age  or  older  who 
commit  the  most  serious  violations  of 
section  IQ 20  eligible  for  federal  prostcu* 
tion  in  coses  where  the  Attorney  Can- 

certifies  that  such  prosecution  is  uwugAimvu  jmnwuwi  i'CX'UAMHt  1H  a  toss 
appropriate*  In  conjunction  with  the  534,3  million  that  could  have  been 
elimination  of  the  six-month  mends*  for  Indian  reservation  road  build* 
tory  minimum*  this  legislation  will  1«S* 

provice  a  balanced,  measured  approach  «*  previous  enacting  legislation 
to  iuvoniif  hacking  crimes,  ajnoe  1SS2,  federal  funds  intended  for 


cem^d  about  our  Native  American 
communities,  Unemployment  ratas 
today  In  Indian  Country  frequently  top 
•amferreC  to  the  se  starts.  I0,  J9' ®od  ev®n  59  per cenc -Mr.  Press- 

In  FY  1838,  the  amount  deducted  for  e  J!f'  ,  *  nattof!  *bw»c  »ot  stand  &y 
this  transfer  to  states  from  the  IRR  t  u,  Is  literally  being 

program  was  $24,2  million.  In  FY  1353,  Jfi,£  behtf,ri  - - —  - 

it  'waa  $2L7  miOior*;  and  In  FY  2000*  the 
obUgaclofi  limitation  resulted  in  a  lm$ 

^  e-  *  n  ^j4l)  .1  -  ^  >  I  1  < 


^  crimes,  ass*,  inxenuera  lor  —  y**is,*  *»>*«  ajua*a«a 

Again,  these  sre  just  the  first  steps  IRR  programs  have  been  used  far  IRR  iiVs5  co  kelp  the  Native  American 
hat  should  be  taken  in  a  very  Ions  purposes*  Only  in  TEA-21  this  Comfnun^*s  ^fijoy  the  same  lovei  of 


that  should  be  taken  in  a  very  long  purposes*  Only  ah  a  c^-i*  crus 
battle  against  cyber  crime  that  many  of  changed  due  to  the  application  of  the 
us  will  svagt  for  years  to  come*  And  obligation  limitation  to  Federal  Lands 
while  we  fight  computer  crime  bv  Highways  and  the  IRR  program 
modifying  out  criminal  lews,  wa  also  bill  will  simply  exclude  tha  IRR 

should  seek  concomitant  way*  to  fully  program  fnsm  this  annual  deduction 
protect  the  fundamental  rights  of  inno-  bos  totaled*  in  the  pest  three 


left  behind.  Perhaps  more  than  any 
other  community  in  America,  the 
Tabes  and  Alaska  Native  Village*  suf- 
inadequate  infrastructure. 

This  ye&r  I  am  pkased  to  be  working 
with  President  Clinton*  Senators 
Daschle,  Oomehicl  and  Others  on  a 

number  of  new  pregrams  and  initia- 
tlvss  to  help  the  Native  American 


— — k 

cent  indMduaU  on  the  Internet 
I  want  to  thank  Senator  K\%  for  join* 
ing  me  in  introducing  this  bilk  As 
chairman  of  the  Subcommittee  on 
Technology.  Terrorism,,  and  Covero* 
ment  Informatien,  I  know  that  he 
carts  deeply  about  these  issues  and  I 
lock  forward  to  working  with  him  or 
this  cc mmonsense,  bipartisan  legisla¬ 
tion.  *  ^ 

Bv  Mr.  DOMHNICI 
Mr.  3t?*camx:*  and 
cu$3: 

S,  2033,  A  bill  to  amend  the  Traj-ispor- 
cstlon  Hqu icy  Act  for  the  21st  Concur/ 
to  ensure  that  full  obligation  author. tv 
is  provided  for  the  Indian  reservation 
roads  program;  to  the  Committee  on 
r.nvircr.n'sent  and  RubUc  Works* 

THE  “  AU.ST<iRCAT;ON  ECt'rTV  aCT  FOR  TJiE  iJSt 
ctNTuar  axc  ,wou*/  j?E5tsvxr:c.v 
*  Mr.  CCMcNICL  Mr.  RnsaidenL  I  am 
pleased  today  to  be  iGintd  bv  my  csL 
.aa^ies  Jzf?  BincauaN  and  'Max  Sac- 
vV3  in  introducing  legisiacon  to  pr»- 
^fr  -  Pilous  doUars  allocated  by  the 
uengroso  and  the  President  for  can- 
ttaxctian  cf  Indian  reservation  roods. 

4  r,or  i  -3  on  doubt  that  the  Indian  ras^ 
e^at;cn  road  iysrsm  i$  the  ecorest 


years,  more  than  5S0  million*  ThL 
money,  while  helpful  to  many  states,  is 
mora  badly  needed  on  Indian  reserva* 
tions  and  should  be  preserved  for  that 
purpose*  By  excluding  the  IRR  program 
from  this  obligation  limitation  provi 


economic  prosperity  as  the  ret?  of 
America.  In  this  respect,  the  Tribes  are 
no  different  than  the  rest  of  America— 
to  promote  their  economic  develop¬ 
ment  basic  infrastructure  must  first  fee 
in  place.  The  President  s  initiative  rec- 
ognjtes  this  fact.  The  bill  we  are  intro* 
duemg  today  addresses  one  element  of 
that  initiative — the  need  for  basic 
transportation*  including  roads  and 
transit.  This  bill  will  help  promote 
transportation  on  every  reservation  in 


wwmi  5.ixaji  ywn^uvti  jjruvi*  vi*  ^ivciy  re5,erva.tivn  tfj 

sioa  we  will  be  increasing  federal  -^erlca  by  fully  funding  the  Indian 
funds  for  Indian  roads  without  incraas-  Rflsetn'ation  Roads  Program, 
log  the  cost  of  the  total  program*  We  ^irst  established  in  132$.  the  Indian 
win  be  focusing  the  funds  for  Indian  Reservation  Roods  program  is  one  of 
roads  on  Indian  roads,  as  we  have  in-  ^ys  America  meets  its  special  re 


fund  in  1S£1 

I  urge  my  colleagues  to  join  us  in  re- 
directing  funds  intended  for  Indian 
mad  construction  to  be  dedicated  to 
that  purpose  * 

Mr.  SIXC AMAN.  Mr.  President*  I  am 
pleased  to  join  today  with  mv  good 
friend  and  colleague  from  New  Mexico, 
Senator  DcmSMCL  to  introduce  this 
bill  along  with  Senator  BalCLS.  This 
bill  assures  that  our  Native  American 
communities  have  the  funding  th«y 
need  for  critical  transportation 
projects.  Cur  bill  4vill  fund  the  Indian 
Reservation  Road  Program  for  the  next 
there  years  with  at  least  iZ?$  million 
per  year,  the  full  ameunr  author uoo  by 
Congress 


- —  '  ** 4 ***«:, 

ervatlon  Roads  program  i$  to  provide 
cafe  and  economic  me&ns  of  tra*^por- 
radon  throughout  Indian  Country- 
Over  the  years,  the  program  has  been 
reauthorized  and  modified  to  help  meet 
the  Tribes*  needs  for  basic  transpor¬ 
tation  infrastructure.  Most  recently* 
the  program  was  reauthorized  for  six 
years  In  1333.  Th<a  program  is  ploying  a 
critical  role  In  economic  development, 
self-determination*  and  employment  of 
Native  Americans  in  33  states,  Includ¬ 
es  Alaska  Native  Villages. 

LurrcRtly,  the  reservaciori  roads  sys¬ 
tem  comprises  2S.TC0  miles  of  3LA-  and 
Tribal -owned  roads  sad  2S,300  miles  of 
state,  county  and  local  roods,  Ther* 
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(1)  by  inserting  “or  trap  and  trace  device” 


2  after  “pen  register”; 

3  (2)  by  mserbEg  routing,  addressing.”  after 

4  “dialing”;  and 

5"  '  .  (3)  by  striking  “ca2  processing”  and  inserting 

6  “the  processing  and  transmitting  of  wire  and  elec- 

7  tronk  comimmications”. 

8  fb)  Issruxes  of  Obbehs. — 

9  (1)  In  gsn’fPvAL.— -Subsection  (a)  of  section 

10  3123  o:  thsi  tide  is  amended  to  read  as  follows: 


11  “(a)  Uf  GaNERai.— (1)  Upon  an  application  made 

12  under  section  3122(a)(1)  of  this  title,  the  court  shall  enter 

13  an  ex  parte  order  authorising  the  installation  and  use  of 

14  a  pen  register  or  trap  and  trace  deuce  if  the  court  Suds 

15  that  the  attorney  for  the  Government  has  certified  to  the 

16  court  that  the  information  likely  to  be  obtained  by  such 
I?  installation  and  use  is  relevant  to  an  ongoing  criminal  in- 
13  vestigation  The  order  shall,  upon  service  or  the  order, 
19  apply  to  any  entity  providing  ■wire  or  electronic  conunu- 


20  mcation  service  zu  use  GtawsS  ^ c ^ c 


2 1  required  to  effectuate  he  order. 

22  “(2)  Upon  an  application  made  under  section. 

23  3122(a)(2)  of  this  tide,  the  court  shall  enter  an  ex  parte 

24  order  authorizing  the  installation  and  use  of  a  pen  register 
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if  tlie  court  finds  th&t  zht  St&t&  Isw  ^morcsmcnt  or  *nv€$* 
tigative  officer  hss  cerfified  to  the  court  that  tns  UL.onns.- 
tioa  likely  to  be  obtained  by  such  installation  and  use  is 
relevant  to  an  ongoing  criminal  investigation.”. 

(2)  Contents  of  okdse.— Subsection  (b)(1) 
of  that  section  is  amended— 

(A)  in  subparagraph  (A)— 

(I)  by  inserting  “or  other  facility” 
after  “telephone  line”;  and 

(ii)  by  inserting  before  the  semicolon 
at  the  end  “car  applied”;  and 

(B)  by  striking  subparagraph  (C)  and  in* 
setting-  the  following  new  subparagraph  (C): 

“(C)  a  description  or  the  communications 
to  which  the  order  applies,  including  Cue  num¬ 
ber  or  other  identifier  and,  if  known,  the  loca¬ 
tion  of  the  telephone  line  or  other  facility  to 
which  the  pea  register  or  trap  and  trace  device 
is  to  be  attached  or  applied,  and,  in  the  case  of 
*  -  — *■  order  auct*ommg  . . —  w..  c  — 

trap  and  trace  device  under  subsection  (a)(2), 
the  geographic  limits  of  the  order,  and”. 

(3)  MONDISCLOSUE*  BSQTIBSOGNTS. — Sub- 
section  (d)(2)  of  that  section  is  amended— 
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(A)  by  inserting  “or  other  faculty’  after 
“the  lice”;  and 

(B)  by  striking  “or  v?ko  has  been  ordered 
by  the  coon”  and  inserting  “or  applied  or  who 
is  obligated  by  the  order511. 

(c)  EMHtRGENCr  IkTTaLLaXION. — Section 

>  125(a)(1)  of  that  title  is  amended — 

{1}  in  subparagraph  (A),  by  striking  “or”  at 
the  end; 

(2)  in  subparagraph  (B),  by  striking  the  comma 
at  the  end  and  ins  erring  a  semicolon;  and 

{3}  by  inserting  after  subparagraph  (B)  the  fol¬ 
lowing  new  subparagraphs: 

“{€)  immediate  threat  to  the  national  se¬ 
curity  interests  of  the  Baited  States; 

“(D)  immediate  threat  to  public  health  or 
safety  or 

“(B)  an  attack  on  the  integrity  or  avail¬ 
ability  of  a  protected  computer  which  attack 
would  be  an  offense  punitkabU  under  ;h:: 
1030(c)(2)(C)  of  this  title/5. 

(d)  B*?Es17I0KS.™ 

{1}  COUKT  OF  C0XP272AT 1  •  JURISDICTION. — 


24 


Paragraph  (2)  of  section  3127  of ,  that  title 


if  oor 

iJOOS 
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amended  by  sinking  subparagraph  (A)  anu  uasemug 
the  following  new  subpangraph  {A); 

“(A)  any  district,  court  of  the  United 
States  {including  a  magistrate  judge  of  such  a 
court)  or  any ’United  States  Court  of  Appeals 
having  jurisdiction  over  the  offense  being  isves- 


(2)  Pen  segister.— Paragraph  (3)  of  that  sco¬ 
rn  is  amended— 


(A)  by  striking  “electronic  or  oth 


,er  im¬ 


pulses”  and  a2  Chat  follows  through  “is  at¬ 
tached”  and  inserting  “dialing,  routing,  ad¬ 
dressing,  or  signalling  information  transmitted 
by  an  tomcat  or  faculty  from  which  a  wire 
or  electronic  communication,  is  transmitted55; 


(B)  by  inserting  “or  process"  after  “de¬ 
vice5 1  each  place  it  appears. 

(3)  TAa?  i>D  T3A3  DEVICE.— Paragraph  (4) 
o:  that  section  :s  onercsd — 

(A)  by  inserting  “or  process"  after  “a  de¬ 


sses":  one 


(3)  by  striking  “of  an  instrument"  and  ail 
that  follows  through  the  end  and  inserting  “or 
other  cidks,  roctirg,  addressing,  and  tignai- 
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1  lin.g  information  relevant  to  identifying  Jis 

2  source  of  3  "wire  or  electronic  c o mmu  m cation^  , 

3  $EC-  2.  MODIFICATION  OF  PROVISIONS  RELATING  TO 

4  FRAUD  AND  RELATED  ACTIVITY  IN  connec- 

5  .  TION  WITH  COMPUTERS. 

6  (a)  Penalties— Subsection  (e)  of  section  1030  of 

7  title  IS,  United  States  Code,  is  mended— 

(1)  in  paragraph  (2}-~ 

(A)  in  subparagraph  (A) — 

(i)  by  inserting  “except  ss  provided  in 
subparagraphs  (B)  and  (C),“  before  “a 


8 

9 

10 

11 

12 


13 


14 

15 

16 

17 

18 

19 

20 

21 

nn 

/  -A 

24 


tine  ; 

(il)  by  striking  '‘(a)(S}(G}/!  and  in¬ 
serting  “(a)(5)”;  and 

(iu)  by  striking  “and”  at  the  end;  - 
(B)  in  subparagraph  (B)— 

(j)  by  inserting  “or  an  attempt  to 
commit  an  offense  punishable  under  this 
subparagraph,”  after  “subsection  (a)(2),” 
in  the  matter  preceding  clausa  (il:  :e2 
(h)  by  adding  “and*’  at  the  end:  and 
(G)  by  striking  subparagraph  (C)  and  in¬ 
serting  die  following  new  subparagraph  (C): 

“(C)  a  due  under  this  title  or  imprisonment  for 
:ot  more  fhan  10  years,  or  both,  in  the  case  or  an 


SI  007 


iooi 
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I 

offense  under  subsection  (a.)  (5;  (A)  or  (2,)(o)(S),  or 

2 

an  attempt  to  commit  an  offense  punishable  under 

3 

this  subparagraph,  is  the  offense  caused  (or,  in  the 

4 

ease  of  an  attempted  offense,  would,  if  completed. 

5  . 

'have  caused) — 

6 

«(i)  loss  to  one  or  more  persons  during  any 

7 

one-year  period  (including  loss  resulting  from  a 

3 

related  course  of  conduct  affecting  one  or  more 

9 

other  protected  computers)  aggregating  at  least 

10 

$5,000  in  value; 

a 

“(ii)  the  rsodirication  or  inpayment,  or 

12 

potential  modification  or  impairment,  of  the 

13 

medical  esaminahon,  diagnosis,  treatment,  or 

14 

care  of  one  or  more  incrudasls: 

15 

"(iii)  physical  injury  to  any  person.; 

16 

«(jv)  a  threat  to  public  health  or  safety;  or 

17 

"(v)  damage  affecting  a  computer  system 

18 

used  by  or  for  a  government  entity  in  further- 

19 

ance  of  the  admirisiration  of  justice,  national 

20 

defense,  or  zsdonzi  securing  and”; 

21 

(2)  by  redesignating  subparagraph  (B)  of  para- 

,  y 

22 

graph  (3)  as  paragraph  (4); 

■r\*> 

/ 

>*  w 

(3)  m  paragraph  (3) — 

74 

(A)  by  striking  “(A)”  at  the  beginning; 

25 

and 

ao 
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S 

(3)  by  striking  ",  (a)(5)(A),  (a)(5)(B) /’.; 

*  t 

1 

X. 

1 

** 

D 

ana 

(4)  3  paragraph  (4),  as  designated  by  para- 

A 

graph  (2)  of  this  subsection,  by  striking  “(a)(4), 

5 

'(a)(5)(A),  (a)(5)(B),  (a)(5)(C)/’  and  inserting 

6 

“(a)(2),  (a)(3),  (a)(4),  (a)(6)/’. 

7 

(b)  Definitions. — Subsection  (e)  of  that  section  is 

g 

amended— 

9 

(1)  k  paragraph  (2)(B),  by  inserting  imelud- 

10 

ing  a  ccmpoter  located  outside  the  United  States” 

11 

before  the  semicolon; 

12 

(2)  in  paragraph  (7),  by  striking  “and”  at  the 

13 

end; 

14 

V 

(3)  by  striking  paragraph  (S)  and  inserting  the 

15 

following  paragraph  (o): 

16 

“(S)  fee  term  ‘damage’  means  any  impairment 

17 

to  the  integrity  or  availability  of  data,  a  program,  a 

IS 

system,  or  information/’; 

19 

(4)  in  paragraph  (9),  by  striking  the  period  at 

20 

the  end  &a  mserbag  ;  anc* ;  arm 

21 

(5)  by  adding  at  the  end  the  following  new 

yj 

paragraphs: 

23 

«n0)  fee  term  ‘confection’  mah  include  an  ad- 

24 

indication  of  juvenile  delinquency  for. a  violation  of 

25 

Sou 

docs 
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1  "(ll)  the  term  loss’  means  any  reasonable  cost 

2  to  any  victim,  including  the  cost  of  responding  to  an 

3  offense,  conducting  a  damage  assessment,  and  re- 

4  storing  the  data,  program,  system,  or  information  to 

5  . its  condition  prior 'to  the  offense,  and  any  revenue 

6  lost  or  cost  incurred  because  of  interruption  of  serv- 


7  ice.". 

8  (a)  IXcos BS  IK  Civil  Acno?^,— Subsection  (g)  of 

9  that  section  is  amended  in  the  second  sentence  by  striking 
10  “involving  damage”  and  all  that  Mows  through  the  pe¬ 
ll  riod  and  inserting  “of  suoseetion  (a}(o)  shah  be  limited 

12  to  loss  unless  such  action  includes  one  of  the  elements  set 

13  forth  in  clauses  (ii)  through  (v)  of  subsection  (c)(2)(C)”. 

14  (a)  CBDGKAL  ?CEFSrnJKS,— That  section  is  farther 

15  amended  by  adding  at  the  end  the  following  new  sub- 


16  section: 

17  «(i)(l)  The  court,  in  imposing  sentence  on  any  person 
I  B  convicted  of  a  violation  of  this  section,  shall  order,  in  addi- 

19  tion  to  any  other  sentence  imposed  and  irrespective  of  any 

20  provision  of  Stats  law,  that  sucn  p&rccr.  r oners  tr  me 


21  United  States — 

22  “(A)  the  interest  of  such  person  in  any  prop- 

23  eny,  whether  real  or  personal,  that  was  used  or  in- 

24  tended  to  be  used  to  commit  or  to  facilitate  the  coxn- 

25  mission  of  sum  uoia*;orr  ar.d 


3§<12 

®cio 
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"(B)  any  property,  whether  reel  or  personal, 
constinitm*  or  derived  from  my  proceeds  that  suer 
person  obtained,  whether  directly  or  indirectly,  as  a 
resuit  or  such  riolanon. 

...  “(2)  The  criminal  forfeiture  of  property  -under  this 
subsection,  ary  seizure  and  disposition  thereof,  and  any 
administrative  or  judicial  proceeding  relating  thereto,  shall 
be  governed  by  the  provisions  of  section  413  of  the  Con¬ 
trolled  Substances  Act  {21  U.S.C.  853},  except  subsection 
(d)  of  that  section.”. 

{e}  Crm  FoEjEITUSS. — That  section,  as  amended 
by  subsection  (a)  of  this  section,  is  farther  amended  by 
adding  at  the  end  the  following  new  subsection: 

**{j){X)  The  following  shall  be  subject  to  forfeiture  to 
the  United  States,  and  no  property  right  shall  exist  In 


“(A)  Any  property,  whether  real  or  personal, 
that  is  used  or  intended  to  be  used  to  commit  or  to 
facilitate  the  eommsaou  of  any  violation  of  this  see- 


“(B)  Any  property  whether  res 


Cv**v**j 


that  constitutes  or  is  cenvea  nrojn  proceeds  traos 
able  to  any  yiojohon  af  this  section. 
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1  “(2)  The  provisiotts  of  chapter  48  of  this  uxle  relating 

2  to  civil  forfeiture  shall  apply  to  any  seizure  or  chfl  for* 

3  feiture  under  this  subsection.'". 

4  SEC,  3.  JUVENILE  DELINQUENCY. 

5  -  Qanse  (3)  of  the  Srsi  paragraph  of  section  5032  of 

6  title  IS,  United  States  Code,  is  amended — 

7  {1}  by  striking  ‘"or”  before  “section  1002(a)’5; 

8  (2)  by  strSdng  “or”  before  "section  324(b)”; 

9  and 

10  (3)  by  inserting  after  ""or  (h)  of  this  title, ”  the 

11  following:  "or  section.  1030(a)(1),  {a)(2)(B}:  or 

12  (a)(3)  of  this  title,  or  is  a  felony  ■violation  of  section 

13  1030(a)(5)  of  this  title  where  such  violation  ox  such 

14  section  1030(a5(5)  is  punishable  under  clauses  (2) 

15  through  (v)  of  section  1030(e)(5)(C)  of  this  title,”. 

1 6  SEC.  4,  AMENDMENT  TO  SENTENCING  GUIDELINES. 

17  Section  805(e)  of  the  Antiterrohsm  and  Effective 

18  Death  Penalty  Act  of  1938  (Public  Law  104-132;  28 

19  U.S.C.  994  note)  is  amended  by  striking  "paragraph.  (4) 

20  cr  (5}“  and  mserdag  "paragraph  (1)  cr  a  filer." 

2 1  of  paragraph  (5)  ( A)  ” . 
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May  4,  2000 


Re:  HIGH  TECH  CRIME  LEGISLATION 
TLU  LEGISLATIVE  PROPOSALS 


'  '  .  This  is  to  alert  you  to  the  on-going  efforts  of  the  Technology  Law 

Unit  in  assisting  OPCA  in  addressing  the  FBI's  criminal  legislative  needs  relating  to 
computer  and  Internet  investigations  as  well  as  responding  to  issues  generated  by 
various  legislative  proposals  being  submitted  by  members  of  Congress. 

Attached  are  a  series  of  documents  which  may  be  broken  down 
into  two  (2)  groups:  1 )  Amendments  (with  legal  analysis)  which  the  FBI  supports  to 
existing  bills  currently  filed  and  under  consideration,  and;  2)  Proposed  amendments  the 
subject  matter  of  which  is  not  currently  proposed  bill.  Some  significant  portions  of  these 

materials  represent  adaptations  of  proposals  we  support  and  which  have  been  - — . 

hammered  out  with  CCIPS  over  tire  past  several  months.  We  understand  from  CCIPS 
that  most  of  these  proposals  have  been  approved  by  the  administration  to  be  “shopped 
around"  and  CCIPS  is  generally  aware  of  our  providing  technical  drafting  assistance  and 
commentary  to  the  staffs  of  members  of  Congress.  This  has  been  a  time-intensive 
process  which  has  absorbed  significant  TLU  resources  with  regular  assistance  from  1LU 
.  and  is  expected  to  continue  until  the  end  of  the  current  legislative  session. 


In  addition,  this  is  to  alert  you  that  TLU’sl^^^^^_„, 
rill  be  accompanying  OPCA  on  Thursday,  May  4, 2000  and  Friday 
to  meet  with  Senator  Hatch's  staff  and  Senator  DeWine's  staff  regarding  high  tech 
issues  and  FCC  merger  approval  deadline  issues  (S.467)  respectively. 


Patrick  W.  Kelley 
Deputy  General  Counsel 
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PRIORITY  OF  MATTERS  CONTAINED 
IN  BELLS  CURRENTLY  UNDER  CONSIDERATION. 


1)  Support  funding  for  Technical  Support  Center  and  Regional  Computer  Forensic 
Laboratories.  (Hatch) 

2)  “Tweaking’"'  of  language  in  the  amending  Pen  Register/Trap  and  Trace  Statute, 
(Kyl/Schumer) 

3)  '  “Tweaking”  of  language  amending  the  Computer  Fraud  Statute. " 

(Kyl/Schumer  and  Hatch) 

4)  Oppose  Expansion  of  Secret  Service  18  U.S.C,  §1030  jurisdiction.  (Hatch) 


l 
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MATTER  CONTAINED 


Support  funding  for  Technical  Support  Center  and  Regional 
Computer  Forensic  Laboratories 


1 
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MATTER  CONTAINED 

IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 

“Support  funding  for  Technical  Support  Center  and  Regional  Computer  Forensic 
Laboratories” 


1 


5/24/02  Release  -  Page  J 


Support  For  Direct  Funding  to  the  FBI  for  tire 
National  Cyber-Crime  Technical  Support  Center 

The  FBI  strongly  supports  without  reservation  the  provisions  of  section  109(a)  of  S.2448 
as  a  necessary  and  critical  element  in  United  States’  strategy  to  combat  cyber-crime  on  a  national 
and  international  level.  The  absence  of  adequate  technical  resources  dedicated  to  the  assistance 
of  law  enforcement  in  this  arena  undermines  daily  the  investigative  efforts  of  federal,  state  and 
local  law  enforcement  officers  dedicated  to  addressing  the  most  troubling  aspects  of  computers 
and  the  Internet  such  as  chSd  sexual  exploitation,  the  dissemination  of  child  pornography,  the 
wholesale  theft  of  intellectual  property,  the  theft  and  disclosure  of  valuable  trade  secrets  as  well 
as  countless  more  traditional  crimes  now  being  facilitated  by  the  use  of  computers.  The  FBI’s 
existing  technical  expertise,  established  with  the  FBI  Laboratory  Divisions ’s  Engineering 
Research  Facility,  demonstrates  the  prudence  in  providing  funding  dedicated  for  these  expressed 
purposes  directly  with  the  Director  of  the  FBI  as  the  most  effective  means  of  ensuring  that  such  a 
facility  is  constructed  and  made  operational  with  the  least  delay  possible.  Senate  Bill  244S's 
approach  is  necessary,  prudent  and  expeditious. 


1 
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Support  for  Direct  Fundiag  to  the  FBI  for  the  Creation  of 
Regional  Computer  Forensic  Laboratories 


The  FBI  also  supports  without  reservation  the  provisions  of  section  109(b)  of  S. 2448 
authorizing  direct  funding  to  the  FBI  for  the  express  purpose  of  creating  up  to  ten  (10)  Regional 
Computer  Forensic  Laboratories  (RCFLs). 

The  FBI  notes  that,  by  separating  Binding  for  RCFLs  under  section  1 09(b)  of  S  .  2443 
from  State  Binding  for  task  forces  and  other  DOI  controlled  investigative  initiatives  under 
109(c),  the  bid  implicitly  acknowledges  the  difference  between  a  true  computer  forensics 
capability  which  is  and  should  be  an  objective,  scientific  function  and  a  computer  investigative 
capability1,  and  have  appropriately  chosen  to  lodge  responsibility  for  the  former  with  tbeFBI 
through  its  laboratory  division. 

It  is  well  known  that  the  FBI  Laboratory  Division  was  instrumental  in  the  development 
and  realization  of  a  Regional  Computer  Forensic  Laboratory  in  San  Diego,  California  at  which 
federal,  state  and  local  law  enforcement  officers  work  side  by  side  sharing  both  expertise  and 
expensive  equipment  and  software  vital  to  the  forensic  recovery  of  often  critical  criminal 
evidence  from  computers  and  other  digital  media.  The  FBI  Laboratory  utilized  its  own  financial 
resources  to  make  the  San  Diego  RCFL  a  reality  and  is  providing  extensive  computer  forensic 
training  to  state  mid  local  officers  of  that  facility  both  at  the  FBI  Academy  and  through  computer 
industry  recognized  training  programs.  The  FBI  Laboratory  Division  now  has  some  twenty  (201 
years  experience  k  the  science  of  computer  forensics  through  its  Computer  Analysis  Response  * 
Team  (CART).  With  CART  scheduled  to  expand  from  its  current  forensic  complement  of  over 
120  examiners  to  over  300  by  the  beginning  of 2002  (which  will  continue  to  secure  its  place  as 
the  single  largest  computer  forensic  entity  k  the  world),  it  only  makes  good  sense  to  harness  the 
m  s  expertise  and  knowledge  of  scientific  method  and  forensic  “best  practices”  as  the  means  of 
jump  starting  a  legitimate  state  and  local  computer  forensic  capability.  'The  key  to  the  success  of 
the  San  Diego  RCFL  will  be  the  key  to  success  for  future  RCFLs,  namely  the  ability  to  move 
quickly  with  a  minimum  of  administrative  expense,  overhead  or  red  tape*  S.2448's  direct 
funding  appropriation  make  this  possibility  a  reality. 

_  For  these  and  many  other  reasons,  the  FBI  strongly  supports  the  allocation  of  direct 
funding  for  RCFLs  to  the  FBI. 


A  Computer  investigate  capability  typically  requires  specially  trained  officers  who  arc  versed  in  Internet 
culture.  Internet-based  poaa  said  cthe  fraud  schemes  as  well  as  Internet  chat  vernacular  enabling  them  to  go  on-line 
undercover  to  detect  and  investigate  criminal  behavior.  In  comparison,  the  locus  of  a  computer  forensics  eapabiktv 
is  t he  recovery,  extraction,  interpretation  and  stabilimiont  of  digits  evidence,  usually  from  digital  stora  ge  media 
such  as  a  computer  hard  drive  seized  as  a  result  of  a  computer  in  vestigation.  Computer  forensic  examiners  tvpicallv 
are  required  to  possess  and  master  a  tar  more  detailed  knowledge  of  electronics,  computer  hardware  assembly  and  ’ 
operation  and  software  programing  and  operation  than  would  be  necessary  for  a  computer  investigator.  A  comouter 
forensic  faerhty  is  more  detached  from  heat  of  the  investigates  and  employs  scietairicaUy  proven  w  acceoted  * 
methodologies  to  recover  either  inculpatory  or  exculpatory  evidence  from  a  digital  medium. 
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'TweaMng”  of  language  in  the  amending  Pen  Register/Trap  and  Trace  Statute, 
(Kyi/Schumer) 
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Amendments  to  the  Pen  Register  and  Trap  &  Trace  Statitte 


It  is  suggested  that  the  last  sentence  of  the  proposed  modification  of  18  U.S.C.  § 
3 122(a)  (and  its  legislative  history)  be  changed  to  make  dear  that  service  of  the  new  single, 
nation-wide  court  order  is  not  required  upon  all  providers  in  the  communication  chain  ifa  single 
provider  has  access  to  ail  transmission  data.  The  suggested  change  is: 


9 

11 


13 

IS 


17 


19 

21 


It  Is  also  suggested  that  the  proposed  revision  to  3 123  subsection  (b)  (1),  new 
subparagraph  (C)  be  changed  for  the  reasons  stated  below  in  the  proposed  legislative  history: 

“(C)  a  description  of — 

,  ®  the |edi|c|l nahme  of  tp;Comniunicafions  to  which  the  order  applies, 
sdpras)yific!uding-the  number  or  other  identifier5* 


23 


25 

27 

29 

31 

33 

35 

37 

39 


41 


Proposed  Legislative  History 

Existing  Subsection  (C)  is  intended  to  require  the  identification  of  the  “facility”  to  which  the  pen 
register  or  trap  and  trace  is  applied.  Historically  this  was  accomplished  by  Identifying  the 
telephone  number  of  the  targeted  telephone,  and  if  known  the  physical  location  of  that  telephone. 
W  ith  the  increase  in  electronic  communications  via  e-mail,  chat  sessions,  instant  Messaging,  or 
telenet  sessions,  it  may  not  always  be  possible  to  identity  a  static  “facility.”  In  cases  of  dynamic 
addressing  of  Internet  accounts  and  telenet  sessions  for  example,  it  is  difficult  to  describe  the 
facility  through  a  static  number.  To  address  this,  the  statute  should  permit  the  applicants  to 
describe  the  technical  nature  of  the  communications  as  a  means  of  further  identifying  the  facility 
to  which  the  order  applies.  Examples  might  include  the  computer  protocol  or  computer  language 
utilized,  or  any  dynamically  assigned  message  identification  number  or  code  or  part  thereof" 

The  bill  also  inserts  “routing,  addressing”  into  the  phrase  “dialing  and  signaling  information”  in 
section  3 121(c)  and  other  provisions  of  the  statute.  The  term  “signaling”  has  historically  been 
given  an  expansive  reading  to  include,  in  the  electronic  communications  world  (e.a.,  e-mail) 
much  of  what  would  be  “routing  and  addressing”  and  then  some.  It  is  stressed  that  the  insertion 
and  existence  of  “routing,  addressing”  into  the  statute  is  not  intended  to  limit  the  interpretation 
of  t  he  term  "signaling/’ 
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Counting  Prior  State  Computer  Crime  Offenses: 


A  new  §  I030(e)(3  0)  would  define  conviction  to  include  prior  Federal  juvenile 
adjudications  for  violations  of  §  1030.  Given  that  the  majority  of  States  now  have  unauthorized 
computer  access  or  similar  computer  crime  statutes2,  it  is  suggested  that  the  proposed  new 
definition  of  conviction  be  further  expanded  to  include  prior  State  computer  convictions.  The 


'  2  Some  45'States  have  enacted  statutes  prohibiting,  to  varying  degree,  computer  crime: 
AL  Computer  Crime  Act,  Code  of  Alabama,  Sections  13A-8-lG0to  13A-8~103-  AK  Statutes 
Sections  11.46.200(a)(3),  11. 46.484(a)(5),  11.46.740, 11.46.985, 11.46.990;  AZ  Revised  ' 
Statues  Annotated,  Sections  13-2301(E),  13-2316;  CA  Penal  Code,  Section  502;  CO  Revised 
Statutes,  Sections  18-5.5-10.1, 18-5.5-102;  CT  General  Statutes,  Sections  53a-25G  to  53a*261 
52-570b;  DH  Code  Annotated,  Title  1 1,  Sections  931-938;  FI  Computer  Crimes  Act,  Florida 
Statutes  Annotated,  Sections  815.01  to  815.07;  GA  Computer  Svstems  Protection  Act  Georgia 
Codes  Annotated,  Sections  16-9-90  to  16-9-95;  HI  Revised  Statutes,  Sections  708-890  to  780- 
896;  ID  Code,  Title  18,  Chapter  22,  Sections  18-2201,  18-2202;  H  Annotated  Statutes 
(Criminal  Code),  Sections  15-1,  16-9;  IN  Code,  Sections  35-43-1-4, 35-43-2*3;  IO  Statutes, 
Sections  716A.  1  to  716A.16;  KS  Statutes  Annotated,  Section  21-3755;  KY  Revised  Statutes 
Sections  434.840  to  434.860;  LA  Revised  Statutes,  Title  14,  Subpart  D.  Computer  Related 
Crimes,  Sections  73. 1  to  73.5;  ME  Revised  Statutes  Annotated,  Chapter  15,  Title  17-A,  Section 
357;  MD  Annotated  Code,  Article  27,  Sections  45A  and  146;  MA  General  Laws,  Chapter  266 
Section  30;  MI  Statutes  Annotated,  Section  28.529(])-{7);  MN  Statutes  (Criminal  Code), 
Sections  609.87  to  609,89;  Ml  Code  Annotated,  Sections  97-45-1  to  97-45-13;  MS  Revised 
Statutes,  Sections  569.093  to  569.099;  MT  Code  Annotated,  Sections  45-2-101,  45-6-310  45- 
6r  J  1 1 ,  NE  Revised  Statutes,  Article  13{p)  Computers,  Sections  28-1343  to  28-1348'  NV 
Revised  Statutes,  Sections  205.473  to  205.477;  NH  Revised  Statutes  .Annotated,  Sections 
638. 16  to  638:19;  NI  Statutes,  Title  2C,  Chapter  20,  Sections  2C.20-1, 2C;20-23  to  2C:2G-34 
and  Title  2A,  Sections  2A.38A-1  to  2A:3SA-3;  NM  Statutes  Annotated,  Criminal  Offenses 
Computer  Crimes  Act,  Sections  30-16A-1  to  30-16A-4;  NY  Penal  Law,'  Sections  1 55  00  ’ 
156.00  to  156.50, 165.35  subdiv.  10, 170.00, 175.00  NC  General  Statutes,  Sections  14-453  to 
14-457;  ND  Century  Code,  Sections  12.1-06.1-01  subsection  3, 12.1-06. 1-08-  OH  Revised 
Code  Annotated,  Sections  2901.01,  2913.01,  2913.04,  2913.81;  OK  Computer  Crimes  Act 
Oklahoma  Session  Laws,  Title  21,  Sections  1951-1956;  OR  Revised  Statutes,  Sections  164325 
! 64,377;  PA  Consolidated  Statutes  Annotated,  Section  3933;  Ri  General  Laws  {Criminal 
Offenses),  Sections  11-52-1  to  11-52-5  SC  CodeofLaws,  Sections  16-16-10  to  16-16^0  SD 
Codified  Laws,  Sections  43-43B-1  to  43-43B-8;  IN  Code  Annotated,  Computer  Crimes  Act 
Sections  39-3-1401  to  39-3-1406;  TX  Codes  .Annotated,  Title  7,  Chapter  33,  Sections  33*01  to 
33.05;  UT  Computer  Fraud  Act,  Utah  Code  Annotated,  Sections  76-6-701  to  76-6-704:  VA 
Computer  Crime  Act,  Code  of  Virginia,  Sections  18.2-152.1  to  38  2-152  14-  WA  Revised  Code 
-Annotated,  Sections  9A.4S.  100,  9A.52.010, 9A.52. 1 10  to  9A.52, 130  W1  Statutes  Annotated 
Section  943.70;  WY  Statutes,  Sections  6-3-501  to  6-3-505. 
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suggested  additional  language  to  the  proposed  bills’  §  1 03O(e)(lO)  version  would  be: 
and 

(B)  a  conviction  under  the  law  of  any  State  for  a  crime  punishable  hv 
imprisonment  for  more  than  1  year,  an  element  of  which  is  unauthorized 
access,  or  exceeding  authorized  access,  to  a  computer.” 


Given  the  fact  that  most  section  1030  offenders  are  juveniles  and  statistically 
more  likely  to  first  receive  State  juvenile  abdications,  it  is  further  recommended  that  the 
provision  go  even  further  than  that  outline  above  by  including  prior  State  juvenile  adjudications. 

Expanding  the  Definition  of ‘loss”  to  Include  Preventative  Reconfiguration: 

Another  recommendation  for  the  Hatch  BilHs  that  the  proposed  definition  of 

"loss"  in  Section  1030(e)(l  1)  be  made  clearer  to  include  the  cost  of  plugging  holes  in  computer 
defenses  as  a  means  of  preventing  future  attacks—so  called  "preventative  re-  ; 

configuration/reprogramming.B  The  new  language  could  read: 

“(1 0  term  “loss”  means  any  reasonable  cost  to  any  victim,  including  the  cost 
of  responding  to  an  offense,  conducting  a  damage  assessment,  implementation  of 
responsive  s$ojnty  nicfcsurss  or  r^orifigurHtion  r^ssonRblv  csiculfltcd  to  prevent 
and  restoring  the  data,  program,  system,  or  information  to  its 
condition  prior  to  the  offense,  and  any  revenue  lost,  cost  incurred,  or  other 
consequential  damages  Incurred  because  of  interruptien'of  service;” 
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MATTER  CONTAINED 

IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 


Oppose  Expansion  of  Secret  Service  18  U.S.C.  §1030  jurisdiction. 


Executive  Summary 


Basis  of  Opposition  to  Amendment  to  Grant  Concurrent  Jurisdiction  to  the  United  States 

Secret  Service  in  Section  1030  Offenses. 

The  proposed  amendment  to  section  1030(d)  of  Tide  18  would  grant  concurrent 
jurisdiction  to  the  United  States  Secret  Service  (USSS)  to  investigate  all  crimes  found  in  Section 
1030. 


In  1996,  Congress  specifically  iimitpd  the  Secret  Service’s  authority  to  investigate  crimes 
under  IS  U.S.C.  §  1030  to  only  those  offenses  under  subsections  (a)(2)(A)  and  (B),  (a)(3),  (a)(4), 
(a)(5)  and  (a)(6).  The  Senate  Report  accompanying  the  1996  amendment  explained  that: 

ftjhe  new  crimes  proposed  in  the  bill,  however,  do  not  fail  under  the  Secret 
Service’s  traditional  jurisdiction.  Specifically,  proposed  subsection  1030(a)(2)(C) 
addresses  gaps  in  18  U.S.C,  23 14  (interstate  transportation  of  stolen  property), 
and  proposed  section  1030(a)(7)  addresses  gaps  in  18  U.S.C.  1951  (the  Hobbs 
Act)  and  S75  (interstate  threats).  These  statutes  are  within  the  jurisdiction  of  the 
Federal  Bureau  of  Investigation,  which  should  retain  exclusive  jurisdiction  over 
these  types  of  offenses,  even  when  they  are  committed  by  computer. 

S,  Rep.  No.  357, 104th  Cong.,  2d  Sess.  13  (1996). 

Inherent  in  the  1996  changes  was  the  recognition  that  the  statute  was  being  amended  to 
reflect  the  respective  investigati  ve  jurisdictional  limits  existing  at  that  time.  It  was  dear  at  that 
time,  that  the  jurisdiction  of  the  Secret  Service,  found  at  18  U.S.C.  §  3056,  did  not  encompass 
the  types  of  offenses  described  in  Section  1030  (aXi),  (a)(2)(C),  or  (a)(7).3  Given  that  there 
have  been  no  additional  grants  of  investigative  jurisdiction  to  the  USSS  since  that  amendment, 
the  current  proposal  to  grant  jurisdiction  to  the  USSS  is  at  best  questionable.  The  theft  of 
National  Security'  information  which  is  the  type  of  information  Section  1030(a)(1)  was  intended 
to  address  has  never  been  the  subject  of  USSS  jurisdiction,  nor  should  it  be.  In  addition,  the 
U'pes  of  crimes  contemplated  by  1030(a)(2)(C)  and  (a)(7),  as  recognized  by  the  legislative 


3  *Un<fef  the  direction  of  the  Secretary  of  the  Treasury,  the  Secret  Service  is  authorized  to  detect  and  arrest  any 
person  who  violates  - 

O )  section  50$,  509 1 5 10,  S7 1 ,  or  $79  of  this  title  or,  with  respect  to  the  Federal  Deposit  Insurance  Corporation, 
Federal  land  banks,  and  Federal  land  bank  associations,  section  213. 216,433, 493, 657>  709, 1006  1007  $01 1  101 3  $014 
1907,  or  1909  of  this  tide; 

(2)  any  of  the  laws  of  the  United  States  relating  to  coins,  obligations,  and  securities  of  the  United  States  and  of  Iordan 
governments:  or 

(3  )  any  of  the  laws  of  the  United  Sta  tes  relating  to  electronic  fond  trans  fer  frauds,  credit  and  debit  cord  frauds,  an  d 
false  identification  documents  or  de  vices;  except  that  the  authority  conferred  by  this  parag  raph  s  hall  be  exerc  i  sed  subject  tot  he 
agreement  of  the  Attorney  General  and  the  Secretary  of  the  Treasury  and  shall  not  affect  the  authority  of  any  other  Federal  law 
enforcement  agency  with  respect  to  those  law  s. 

Basis  of  Opposition  to  Expanded  Secret  Service  Jurisdiction  under  18  U.S.C.  §1030 
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history,  have  traditionally  been  investigations  solely  k  the  province  of  the  FBI. 


The  1996  provision  is  an  explicit  effort  by  Congress  to  address  the  criminal  offenses  at 
i  ssue  through  a  di  vision  of  labor  primarily  determined  by  investigative  responsibility  and 
expertise.  Any  reversion  to  the  pre- 1996  jurisdictional  provisions  raises  serious  issues  and 
concerns  about  the  utilization  of  resources.  Concurrent  jurisdiction  will  result  in  a  duplication  of 
efforts  that  will  waste  resources  and  will  encourage  independent  investigations  by  separate 
agencies  at  the  expense  of  coordinated  joint  efforts.  "  r 


Basis  ot  Opposition  to  Expanded  Secret  Service  Jurisdiction  under  18  U.S.C.  §1030 
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MATTER  NOT  CONTAINED 
IN  BILLS  CURRENTLY  UNDER  CONSIDERATION. 


Cable  Communications  Act  amendment. 
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Executive  Summary 

Cable  Communications  Policy  Act  Amendment 


The  Cable  Communications  Policy  Act,  passed  in  1984  to  regulate  various  aspects  of  the 
cable  television  industry,  did  not  take  into  account  the  changes  in  technology  that  have  occurred 
over  the  last  fifteen  years.  Cable  television  companies  now  often  provide  Internet  access  and 
telephone  service  in  addition  to  television  programming.  This  amendment  clarifies  that  when  a 
cable  company  acts  as  a  telephone  company  or  an  Internet  service  provider,  it  must  comply  with 
the  laws  governing  the  interception  and  disclosure  of  wire  and  electronic  communications  just 
like  any  other  telephone  company  or  Internet  sendee  provider. 


Cable  Communications  Policy  Act  Amendment 
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UNITED  STATES  CODE  ANNOTATED 
TITLE  47.  TELEGRAPHS,  TELEPHONES,  AND  RADIOTELEGRAPHS 
CHAPTER  5-WIRE  OR  RADIO  COMMUNICATION 
SUBCHAPTER  VAC-CABLE  COMMUNICATIONS 
PART  ^-MISCELLANEOUS  PROVISIONS 


Section  551.  Protection  of  subscriber  privacy 

(a)  Notice  to  subscriber  regarding  personally  identifiable  information;  definitions 

(1)  At  the  time  of  entering  into  an  agreement  to  provide  any  cable  service  or  other  service 
to  a  subscriber  and  at  least  once  a  year  thereafter,  a  cable  operator  shall  provide  notice  in 
the  fontt  of  a  separate,  written  statement  to  such  subscriber  which  clearly  and 
conspicuously  informs  the  subscriber  of— 

(A)  the  nature  of  personally  identifiable  information  collected  or  to  be  collected 
with  respect  to  the  subscriber  and  the  nature  of  the  use  of  such  information; 

(B)  die  nature,  frequency,  and  purpose  of  any  disclosure  which  may  be  made  of 
such  informatio  n,  including  an  identification  of  the  types  of  persons  t  o  whom  the 
disclosure  may  be  made; 

(€)  the  period  during  which  such  information  will  be  maintained  bv  the  cable 
operator, 

OD)  the  times  and  place  at  which  the  subscriber  may  have  access  to  such 
information  in  accordance  with  subsection  (d)  of  this  section;  and 
(E)  the  limitations  provided  by  this  section  with  respect  to  the  collection  and 
disclosure  of  information  by  a  cable  operator  and  the  right  of  the  subscriber  under 
subsections  (I)  and  (h)  of  tnis  section  to  enforce  such  limitations. 

In  the  case  of  subscribers  who  have  entered  into  such  an  agreement  before  the  effective 
date  of  this  section,  such  notice  shall  be  provided  within  1  SO  days  of  such  date  and  at 
least  once  a  year  thereafter. 

(2)  For  purposes  of  this  section,  mher  than  subsection  (h)  of  this  section- 

(A)  the  term  "personally  identifiable  information"  does  not  include  any  record  of 
aggregate  data  which  does  not  identify  particular  persons; 

(B)  the  term  "other  service"  includes  any  wire  or  radio  communications  service 
provided  using  any  of  the  tacilities  of  a  cable  operator  that  are  used  in  the 
provision  of  cable  service;  and 

(C)  the  term  "cable  operator"  includes,  in  addition  to  persons  within  the  definition 
of  cable  operator  in  sect  ion  522  of  this  title,  any  person  who  (I)  is  owned  or 
controlled  by,  or  under  common  ownership  or  control  with,  a  cable  operator,  and 
(ii)  provides  any  wire  or  radio  communications  service. 
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(b)  Collection  of  personally  identifiable  information  using  cable  system 

(I)  Except  as  provided  in  paragraph  (2),  a  cable  operator  shall  not  use  the  cable  system  to 
collect  personally  identifiable  information  concerning  any  subscriber  without  the  prior 
written  or  electronic  consent  of  the  subscriber  concerned. 


(2)  A  cable  operator  may  use  the  cable  system  to  collect  such  information  in  order  to- 

(A)  obtain  information  necessary  to  render  a  cable  service  or  other  sendee 
provided  by  the  cable  operator  to  the  subscriber,  or 

(B)  detect  unautho  rized  reception  of  cable  communications. 


(c)  Disclosure  of  personally  identifiable  information 

(!)  Except  as  provided  in  paragraph  (2)s  a  cable  operator  shall  not  disclose  personally 
identifiable  information  concerning  any  subscriber  without  the  prior  written  or  electronic 
consent  of  the  subscriber  concerned  and  shah  take  such  actions  as  are  necessary  to 
prevent  unauthorized  access  to  such  information  by  a  person  other  than  the  subscriber  or 
cable  operator. 


(2)  A  cable  operator  may  disclose  such  Information  if  the  disclosure  is- 

(A)  necessary  to  render,  or  conduct  a  legitimate  business  activity  related  to,  a 
cable  service  or  other  service  provided  by  the  cable  operator  to  the  subscriber; 

(B)  subject  to  subsection  (h)  of  this  section,  made  pursuant  to  a  court  order 
authorizing  such  disclosure,  if  the  subscriber  is  notified  of  such  order  by  the 
person  to  whom  the  order  is  directed;  t>f 


(C)  a  disclosure  of  the  names  and  addresses  of  subscribers  to  any  cable  service  or 
other  service,  if-- 

(i)  the  cable  operator  has  provided  the  subscriber  the  opportunity  to 

prohibit  or  limit  such  disclosure,  and 

(ti)  the  disclosure  does  not  reveal,  directly  or  indirectly,  the- 

(I)  extent  of  any  viewing  or  other  use  by  the  subscriber  of  a  cable 
service  or  other  service  provided  by  the  cable  operator,  or 

(II)  the  nature  of  any  transaction  made  by  the  subscriber  over  the 
cable  system  of  the  cable  operator^  tj| 


Such  disclosure:  shall  not  include  records  revealing  customer  cable  television 
vievutg  activity.  For  purposes  of  this  section,  “customer  cable  television  viewing 
activity '  shall  mean  the  cable  customer  viewing  habits  of  operator-selected,  pre-' 
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(d)  Subscriber  access  to  information 

A  cable  subscriber  shall  be  pro  vided  access  to  all  personally  identifiable  information  regarding 
that  subscriber  which  is  collected  and  maintained  by  a  cable  operator.  Such  information  shall  be 
made  available  to  the  subscriber  at  reasonable  times  and  at  a  convenient  place  designated  by 
such  cable  operator.  A  cable  subscriber  shall  be  provided  reasonable  opportunity  to  correct  any 
error  in  such  information.  . 


(e)  Destruction  of  information 

A  cable  operator  shall  destroy  personally  identifiable  Information  if  the  information  is  no  longer 
necessary'  for  the  purpose  for  which  it  was  collected  and  there  are  no  pending  requests  or  orders 
for  access  to  such  information  under  subsection  (d)  of  this  section  or  pursuant  to  a  court  order. 


(f)  Civil  action  in  United  States  district  court;  damages;  attorney's  fees  and  costs;  nonexclusive 
nature  of  remedy 

(1)  Any  person  aggrie  ved  by  any  act  of  a  cable  operator  in  violation  of  this  section  may 
bring  a  civil  action  in  a  United  States  district  court. 

(2)  The  court  may  award—  * 

(A)  actual  damages  but  not  less  than  liquidated  damages  computed  at  the  rate  of 
$100  a  day  for  each  day  of  violation  or  $1,000,  whichever  is  higher; 

(B)  punitive  damages;  and 

(C)  reasonable  attorneys’  fees  and  other  litigation  costs  reasonably  incurred. 

( ” }  The  remedy  provided  by  this  section  shall  be  in  addition  to  any  other  lawful  remedy 
available  to  a  cable  subscriber. 

(g)  Regulation  by  States  or  franchising  authorities 

Nothing  in  this  subchapter  shall  be  construed  to  prohibit  any  State  or  any  franchising  authority' 
from  enacting  or  enforcing  laws  consistent  with  this  section  for  the  protection  of  subscriber 
privacy,  "  v " 


(h)  Disclosure  of  information  to  go  vernmental  entity  pursuant  to  court  order 
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Except' $s A  governmental  entity  may  obtain  personally 
identifiable  information  concerning  a  cable  subscriber  pursuant  to  a  court  order  only  i£  in  the 
court  proceeding  relevant  to  such  court  order— 

(1)  such  entity  offers  dear  and  convincing  evidence  that  the  subject  of  the  information  is 
reasonably  suspected  of  engaging  in  criminal  activity  and  that  the  information  sought 
would  be  material  evidence  in  the  case;  and 

(2)  the  subject  of  the  information  is  afforded  the  opportunity  to  appear  and  contest  such 
entity's  claim. 


PROPOSED  LEGISLATIVE  HISTORY  FOR 
AMENDMENTS  TO  THE  CABLE  COMMUNICATIONS  POLICY  ACT 


The  Cable  Communications  Policy  Act  currently  establishes  two  different  sets  of  rules 
regarding  privacy  protection  and  disclosure  to  law  enforcement:  one  governing  cable  service 
(“Cable  Act”)  (47  U.S.C.  §551),  and  the  other  applying  to  the  use  of  telephone  service  and 
Internet  access,  (the  wiretap  statute  (IS  U.S.C  §2510  the  Electronic  Communications 

Policy  Act  f  £CP A”)  (IS  U.S.C.  §2701  et.seg.),  and  the  pen  register  and  trap  and  trace  statute 
(1 8  U.S.C,  §3121  gt  sgff  ).  Yet  today,  unlike  in  1984  when  Congress  passed  the  Cable 
Communications  Policy  Act,  many  cable  companies  offer  not  only  traditional  cable 
programming  services  but  also  Internet  access  and  telephone  service.  The  rules  governing  law 
enforcement  access  to  the  records  of  communication  service  providers’  customers,  however, 
should  not  depend  on  whether  the  customer  has  chosen  to  use  a  cable  company  or  a  more 
traditional  type  of  provider  for  Ids  telephone  or  Internet  service.  Congress  believes  that  cable 
companies  offering  such  services  should  comply  with  court  orders  and  other  legal  process 
permitted  under  the  wiretap  statute,  ECPA,  and  the  pen  register  and  trap  and  trace  statute  with 
respect  to  their  telephone  and  Internet  customers. 

In  recent  years,  however,  cable  companies  have  increasingly  balked  at  complying  with 
such  process,  noting  the  seeming  inconsistency  of  these  statutes  with  their  duty  of  nondisclosure 
(except  under  stringent  limits)  under  the  Cable  Communications  Policv  Act  Seg  in  re 
Application  of  United  States,  36  F.  Sup  p.  2d  __  (D.  Mass.  Feb.  9, 1999)  (noting  apparent 
statutory  conflict  and  ultimately  granting  application  for  order  under  IS  U.S.C.  2703(d)  against 
cable  company  providing  Internet  service).  These  complications  have  at  times  delayed  or” 
frustrated  investigations. 

In  addition,  section  551  flawed  because  it  permits  law  enforcement  to  obtain 
information  only  when  that  information  constitutes  evidence  of  an  offense.  In  some  cases 
however,  the  information  sought  from  a  service  provider  5s  not  evidence  of  a  crime,  even  thotmh 
11  he!Ps  t0  solve  one.  For  example,  law  enforcement  officials  may  try  to  arrest  a  fugitive  who  is 
accessing  his  e-mail  account  from  a  remote  location,  and  they  need  to  obtain  information  from 
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the  cable  company  that  shows  from  what  location  he  is  accessing  that  account.  Moreover, 
whether  law  enforcement  can  obtain  a  court  order  to  obtain  such  information  should  not  depend 
on  whether  the  fugitive  has  chosen  to  connect  to  the  Internet  using  a  cable  company  instead  of  a 
traditional  Internet  service  provider. 


Accordingly,  the  amendment  inserts  a  new  subsection  55 1(c)(2)(D)  to  confirm  that  cable 
companies,  like  other  providers,  remain  subject  to  ECPA,  the  wiretap  statute,  and  the  trap  and 
trace  statute  with  respect  to  the  provision  of  telephone  and  Internet  services,  notwithstanding 
section  551.  The  definition  ofBcustomer  cable  television  viewing  activity”  is  intended  to 
exclude  from  disclosure  under  chapters  1  \%  121,  or  206  of  title  18  of  the  United  States  Code 
traditional  cable  and  broadcast  television  video/audio  presentations  Unlike  Internet  video 
presentations,  the  subject  content  and  timing  of  which  are  selected  by  the  cable  customer,  the 
selection  and  timing  of  television  presentations  are  controlled  by  the  operator.  The  disclosure 
exclusion  is  not  intended  to  encompass  or  prohibit  the  disclosure  by  an  operator  of  records  or 
mformation  relating  to  television  presentations  which  are  re-transmitted  through  the  Internet. 
Records  relating  to  such  re-transmissions  would  be  treated  like  all  other  Internet-related  records 

Tr  Saifrf  ii9,  !21,  or  206  oftit3e  3S-  The  amendment,  however,  is  intended  to  preserve 
me  Cable  Act’s  primacy  with  respect  to  records  revealing  what  ordinary  cable  television 
programing  a  customer  chooses  to  purchase,  such  as  particular  premium  channels  or  “pay  per. 
view  shows.  Thus,  in  a  case  where  a  customer  receives  both  Internet  access  and  conventional 
cable  television  service  from  a  angle  cable  provider,  a  government  entity  can  compel  disclosure 
under  ECPA  only  those  customer  records  relating  to  Internet  service. 
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Executive  Summary 

Necessary  Amendments  to  the  Privacy  Protection  Act  -  42  U.S.C.  §  2060aa,  el  seq. 

.  .  The  pnvaey  Protection  Act  (PPA)  prohibits  law  enforcement  from  searching  for  or 

seiang  work  product  materials  or  documentary  materials  possessed  by  a  person  in  connection 

wt  3  PurPose  to  disseminate  them  to  the  public  in  a  newspaper,  book,  broadcast,  or  other 

srnii  ar  form  of  public  communication.  Originally  adopted  to  prevent  the  search  of  third  party 

news-gathers  m  traditional  media  (e.g.,  newspaper  press  rooms,  tv  editor  offices),  the  PPA  has 

generated  unforseen  obstacles  for  law  enforcement  when  applied  to  the  search  of  a  criminal’s 

personal  computers  tf  the  computers  coincidentally  are  being  used  for  web  site  publishing  A 

scenario  frequently  encountered  by  law  enforcement  involves  the  seizure  of  a  computer  used  to 

disseminate  child  pornography  which  may  coincidentally  also  control  the  e-mail  and/or  websites 

ot  the  suspect  and  third  parties.  Because  of  the  size  of  modem  personal  computer  hard  dri  ves 

cjday  most  computers  cannot  effectively  be  searched  on  scene,  but  are  usually  seized  &$t  then 

searched  later  m  a  computer  forensic  environment  as  expressly  provided  for  by  a  magistrate 

Unfortunately,  such  a  practice  creates  a  dilemma  for  investigators  who  may 

^  l  l  B  tHe  exammatIon  Process  Potential  third  party  news  gatherer  material  may' 

„  he  C?mpT 6r  SySief'  The  reaHz2t!0n  TOa>' be  t0° 1ate  as  the  PPA  prohibits  both  search 

and  seizure  of  such  material. 

_  ,  Amendments  detailed  herein  would  carve  out  a  reasonable  exception  to  the  Act  when  the 

search  or  seizure  of  work  product  materials  or  documentary  materials  is  incident  al  to”  the 

dnwrf  S6Tc  050thtreyidefiC€  rdevant  t0  3  erime-  ^us,  the  seizure  of  a  computer  hard 
m^t,  thfd  part>' for  eV5dsnce  of  child  pornography  would  not  be  prohibited 

Sb  tedTTh^PpT6  hard  driVe  C0nt;uaed  WOrk  produCt  °r  0ther  d0CU!^e"^y  material 
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X  [redime  strikeou  t  version  of  amendments  to  the  Privacy  Protection  Act] 

3  UNITED  STATES  CODE  ANNOTATED 

TITLE  42.  THE  PUBLIC  HEALTH  AND  WELFARE 
5  CHAPTER  21A~PRIV'ACY  PROTECTION 

SUBCHAPTER  I-FIRST  AMENDMENT  PRIVACY  PROTECTION 
7  -  ,,  PART  A-JUNLAWFUL  ACTS 

9  Section  2000aa.  Searches  and  seizures  by  government  officers  and  employees  in  connection  with 

investigation  or  prosecution  of  criminal  offenses 

11 


13 


(a)  Work  product  materials 
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i  notwithstanding  any  other  law,  it  shall  be  unlawful  for  a  government  officer  or  employee  in 
connection  with  the  investigation  or  prosecution  of  a  criminal  offense,  to  search  for  or  seize  any 
work  product  materials  possessed  by  a  person  reasonably  believed  to  have  a  purpose  to 
disseminate  to  the  public  a  newspaper,  book,  broadcast,  or  other  similar  form  of  public 
communication,  in  or  affecting  interstate  or  foreign  commerce;  but  this  provision  shall  not 
impair  or  affect  the  ability  of  any  government  officer  or  employee,  pursuant  to  otherwise 
applicable  law,  to  search  for  or  seize  such  materials,  if- 

(!)  there  is  probable  cause  to  believe  that  the  person  possessing  such  materials  has 
committed  or  is  committing  the  criminal  offense  to  which  the  materials  relate:  Provided 
however.  That  a  government  officer  or  employee  may  not  search  for  or  seize  such 
materials  under  the  provisions  of  this  paragraph  if  the  offense  to  which  the  materials 
relate  consists  of  the  receipt,  possession,  communication,  or  withholding  of  such 
materials  or  the  information  contained  therein  (but  such  a  search  or  seizure  may  be 
conducted  under  the  provisions  of  this  paragraph  if  the  offense  consists  of  the  receipt 
possession,  or  communication  of  information  relating  to  the  national  defense,  classified 
information,  or  restricted  data  under  the  pro  visions  of  section  793,  794,  797  or  79$  0f 
Title  38,  or  section  2274, 2275  or  2277  of  this  title,  or  section  783  of  Title  50  or  "if  the 
offense  involves  the  production,  possession,  receipt,  mailing,  sale,  distribution,’  shipment 
or  transportation  of  child  pornography,  the  sexual  exploitation  of  children,  or  the  sale  or’ 
purchase  of  children  under  section  2251, 2251 A,  2252,  or  2252A  of  Title  18);  m 

(2)  there  is  reason  to  believe  that  the  immediate  seizure  of  such  materials  is  necessary'  to 
prevent  the  death  of  or  serious  bodily  injury  to,  a  human  being-;® 

(3) theseizurepr^antinationofworkproductmatmajsismcidentalto  tBeexecution  of 
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(b)  Other  documents 

Notwithstanding  any  other  law,  it  shall  be  unlawful  for  a  government  officer  or  employee,  in 
connection  with  the  investigation  or  prosecution  of  a  criminal  offense,  to  search  for  or  seize 
documentary  materials,  other  than  work  product  materials,  possessed  by  a  person  in  connection 
with  a  purpose  to  disseminate  to  the  public  a  newspaper,  book,  broadcast,  or  other  similar  form 
of  public  communication,  in  or  affecting  interstate  or  foreign  commerce;  but  this  provision  shall 
not  impair  or  affect  the  ability  of  any  government  officer  or  employee,  pursuant  to  otherwise 
applicable  law,  to  search  for  or  seize  such  materials.  If— 


(1)  there  is  probable  cause  to  believe  that  the  person  possessing  such  materials  has 
committed  or  is  committing  the  criminal  offense  to  which  the  materials  relate;  Provided, 
however,  That  a  government  officer  or  employee  may  not  search  for  or  seize  such 
materials  under  the  pro  visions  of  this  paragraph  if  t  he  offense  to  which  the  materials 
relate  consists  of  the  receipt,  possession,  communication,  or  withholding  of  such 
materials  or  the  information  contained  therein  (but  sucb  a  search  or  seizure  may  be 
conducted  under  the  provisions  of  this  paragraph  if  the  offense  consists  of  the  receipt, 
possession,  or  communication  of  information  relating  to  the  national  defense,  classified 
information,  or  restricted  data  under  the  provisions  of  section  793, 794,  797,  or  798  of 
Title  18,  or  section  2274, 2275,  or  2277  of  this  title,  or  section  783  of  Title  50,  or  if  the 
offense  involves  the  production,  possession,  receipt,  mailing,  sale,  distribution,  shipment, 
or  transportation  of  child  pornography,  the  sexual  exploitation  of  children,  or  the  sale  or 
purchase  of  children  under  section  2251, 2251  A,  2252,  or  2252.4.  of  Title  18); 

(2)  there  is  reason  to  believe  that  the  immediate  seizure  of  such  materials  is  necessary  to 
prevent  the  death  of,  or  serious  bodily  injury  to,  a  human  being; 

(3)  there  is  reason  to  believe  that  the  giving  of  notice  pursuant  to  a  subpoena  duces  tecum 
would  result  in  the  destruction,  alteration,  or  concealment  of  such  materials;  of 

(4)  such  materials  have  not  been  produced  in  response  to  a  court  order  directing 
compliance  with  a  subpoena  duces  tecum,  and** 

(A)  all  appellate  remedies  have  been  exhausted;  or 

(B)  there  is  reason  to  believe  that  the  delay  in  an  investigation  or  trial  occasioned 
by  further  proceedings  relating  to  the  subpoena  would  threaten  the  interests  of 
justicer|H 


<5)  iliiMrif:  pr  examination  of  documentary  materials  is  incidental  to  the.execation  of 

an  otherwi&laMjl'searcfebr  s«me/  "  . 


(c)  Objections  to  court  ordered  subpoenas;  affidavits 
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In  the  event  a  search  warrant  is  sought  pursuant  to  paragraph  (4)(B)  of  subsection  (  b)  of  this 
section,  the  person  possessing  the  materials  shall  be  afforded  adequate  opportunity  to  submit  an 
affidavit  setting  forth  the  basis  for  any  contention  that  the  materials  sought  are  not  subject  to 
seizure. 
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PROPOSED  LEGISLATIVE  HISTORY  FOR 
AMENDMENTS  TO  THE  PRIVACY  PROTECTION  ACT 

^  The  Privacy  Protection  Act  of  1980  ("PPA"),  42  U.S.C.  §  20OOaa,  et  scq..  makes  it 
unlawful  for  local,  state,  or  federal  law  enforcement  authorities  to  "search  tor  or  seize  any  work 
product  material s”  or  any  “documentary  materials ...  possessed  by  a  person  in  connection  with  a 
purpose  to  disseminate  to  the  public  a  newspaper,  book,  broadcast,  or  other  similar  form  of 
public  communication.’*  42  U.S.C.  §  2000aa(a),  .(b),  Use  statute  defines  "work  product 
materials"  as  materials  prepared  or  possessed  in  anticipation  of  communicating  such  materials  to 
the  public,  except  .if  the  materials  constitute  contraband  or  the  Suits  or  instrument  alities  of  crime. 
M.  §  2OQ0aa~7(b),  "Documentary  materials,"  on  the  other  hand,  consist  of  materials  upon  which 
information  is  recorded,  once  again  with  the  exception  of  contraband  and  the  fruits  or 
instrumentalities  of  crime.  Id.  §  200Oaa-7(a).  Thus,  other  than  for  the  exceptions,  the  PPA 
effectively  imposes  a  "no-search"  rule  on  work  product  materials  and  a  "subpoena-first"  rule  on 
documentary  materials  held  by  third  parries  who  plan  to  use  them  to  communicate  to  the  public. 
Although  the  statute  appears  reasonable  on  its  face,  its  application  in  the  current  electronic 
environment  has  inadvertently  shielded  criminal  activities  from  legitimate  law  enforcement 
investigations,  such  efforts  to  arrest  and  prosecute  those  who  distribute  child  pornography  over 
the  Internet. 


(a)  Intent  of  the  PPA 

Congress  passed  the  PPA  in  response  to  the  Supreme  Court’s  decision  in  Zurcher  v. 
Stanford,  Pally,  436  US.  537  (1978).  In  Zurcher,  the  Supreme  Court  upheld  a  police  search, 
pursuant  to  a  valid  search  warrant,  of  the  offices  of  The  Stanford  D  aily  newspaper  for 
photographs  taken  at  the  scene  of  a  crime.  The  Court  rejected  the  newspaper's  claim  that  search 
warrants  eoujdnot  be  used  to  recover  evidence  from  those  engaging  in  Tint  Amendment- 
protected  activities.  Id  at  565-567.  The  Court  also  held  that  law  enforcement  officers  could  use 
search  warrants  m  recover  evidence  from  innocent  third  parties.  Id.  at  555  ("state's  interest  in 
enforcing  the  criminal  law  and  recovering  evidence  is  the  same  whether  the  third  party  is 
culpable  or  not").  The  Court  concluded,  therefore,  that  “the  critical  element  in  a  reasonable 
search  is  not  that  the  owner  of  the  property  is  suspected  of  a  crime  but  that  there  is  reasonable 
cause  to  believe  that  the  specific  'things'  to  be  searched  for  and  seized  are  located  on  the  property 
to  which  entry  is  sought”  Id.  at  556. 

In  response  to  the  Court's  ruling.  Congress  passed  the  PPA.  Congress  intended  to  restrict 
searches  for  mere  evidence  of  crime  held  by  innocent  third  parties  who  were  engaged  in  First 
Amendment-protected  activities  —  evidence  that  law  enforcement  officials  might  otherwise 
obtain  through  less  intrusive  means,  such  as  by  issuing  a  subpoena.  The  purpose  of  restricting 
law  enforcement  in  this  fashion,  of  course,  was  to  protect  the  confident  iality  of  non-evidentiary 
files  also  held  by  this  special  group  of  innocent  third  parries  —  both  the  drafts  of  art  icles  not  yet 
published  and  the  research  and  other  supporting  information  (e.g.,  notes  and  interviews)  which 
they  never  intended  to  publish.  Thus,  the  PPA  protects  an  author  or  publisher  (like  The  Stanford 
Daily)  —  who  is  not  a  suspect  in  the  investigation  —  from  law  enforcement  attempts  to.  search 
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1  through  Ms  or  her  work  product  or  documentary  materials  in  order  to  find  and  seize  evidence. 

To  preserve  the  confidentiality  of  these  designated  materials,  the  PPA  instructs  investigators  not 
3  to  search  for  the  evidence  at  ail,  hut  to  compel  the  innocent  third  parties  to  find  and  produce  it 
themselves.  This  goal  of  Congress  remains  unchanged,  and  our  amendments  do  not  alter  this 
5  protection  for  innocent  third  parties. 
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Congress  never  intended,  however,  to  protect  criminals  from  court-authorized  searches, 
and  the  legislative  history  to  the  PPA  is  replete  with  statements  to  this  effect.  For  example,  the 
Senate  Judiciary  Committee  Report  stated  that  the  purpose  of  the  PPA  is  to  "limit  searches  for 
materials  held  by  persons  involved  in  First  Amendment  activities  who  are  themselves  not 
suspected  ofparticipation  in  the  criminal  activity  for  which  the  materials  are  sought."  $.  Rep. 

No,  96-874, 96th  Cong.,  2d  Sess.  1 1  (19S0),  reprinted  in  1980  U.S.C.C.A.N.  3950,  3957 
(emphasis  added).  Moreover,  the  Committee  Report  stated  that  the  intention  in  enacting  the  PPA 
was  "not  to  Unfit  the  ability'  of  law  enforcement  officers  to  search  for  and  seize  materials  held  by 
those  suspected  of  committing  the  crime  under  investigation."  M.  Indeed,  the  language  of  the 
statute  itself  allows  searches  and  seizures  of  any  person  who  “has  committed  or  is  committing 
the  criminal  offense  to  which  the  materials  relate”  42  U.S.C.A.  §  2000aa(a){l),  (b)(1).  Plainly, 
Congress  had  no  desire  to  inhibit  law  enforcement  investigators  that  need  to  search  the  premises 
of  a  suspected  wrongdoer. 

(b)  The  problem  of  commingling  of  protected  documents  and  evidence 
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Because  Congress  enacted  this  statute  before  the  widespread  proliferation  of  computers, 
it  could  not  fully  consider  the  problem  raised  by  the  commingling  of  protected  information  and 
contraband,  .Although  commingling  can,  of  course,  occur  with  paper  records  —  for  example,  if  a 
reporter  engaging  in  tax  fraud  placed  a  copy  of  the  fraudulent  tax  return  in  a  filing  cabinet  with 
his  or  her  work-related  notes  —  such  commingling  never  presented  a  significant  problem  for  two 
reasons.  First,  the  statute  applied  only  to  members  of  the  traditional  media,  a  limited  group  not 
usually  associated  with  committing  crimes.  Second,  when  searching  for  paper  records, 
investigators  can  generally  examine  records  on  site  and  then  seize  only  those  records  that  are  the 
subject  of  their  warrant.  Thus,  investigators  can  avoid  violating  the  PPA  by  not  “searching  for” 
or  “seizing"  any  protected  material  since  they  do  not  need  to  cany  away  anything  but  the  object 
of  their  search." 


With  the  widespread  use  of  computers  and  the  Internet,  however,  both  of  these  limiting 
factors  have  disappeared.  First,  every  computer  user  has  become  a  potential  publisher.  For 
example,  a  single  computer  can  provide  (I)  an  electronic  “bulletin  board"  for  the  posting  of  news 
items  by  individuals  using  the  Internet;  (2)  user  accounts  where  private  individuals  can  store 
drafts  of  news  items  that  they  intend  to  post  on  the  “bulletin  board";  and  (3)  a  website  from 


Of  course,  investigators  may  briefly  isolate  or  possess  protected  material  during 
the  execution  of  the  warrant,  but  such  possession  occurs  during  the  execution  of  every  search" 
warrant  and  does  npt  constitute  a  seizure. 
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1  which  anyone  with  access  to  the  Internet  could  view  or  download  child  pornography.  Although 
the  second  category  of  data  arguably  constitutes  “work  product”  under  the  PPA,5  law 
3  enforcement  officials  plainly  have  the  duty  to  search  for  and  seize  the  third  category  of  data, 

5  Second,  potential  liability  under  the  PPA  may  arise  for  law  enforcement  officials  in  such 

a  scenario  because  it  has  become  both  unreasonable  and  impractical  and  in  some  instances 
7  technically  impossible  to  search  for  and  seize  the  contraband  without  simultaneously  seizing 

protected  material.  In  the  new  electronic  environment,  where  computer  systems  with  gigabytes 
9  of  storage  have  become  ubiquitous,  law  enforcement  agents  generally  cannot  extract  legally 

seizable  evidence  from  commingled  protected  material  without  actually  seizing,  at  least 
11  temporarily,  those  protected  materials,  or,  perhaps  more  intrusively,  without  moving  into  and 
occupying  the  search  premises  for  extended  durations.  Because  of  the  volume  of  data  to  be 
13  searched  or  because  of  technical  concerns  (e.g.  encryption),  law  enforcement  agents  must  very 
often  remove  the  seized  computer  or  an  exact  copy  of  aB  the  data  to  a  laboratory  for  analysis. 
15 

Moreover,  liability  may  attach  In  such  cases  because  the  prohibition  on  searching  for  or 
1 7  seizing  materials  is  stated  in  the  disjunctive;  violations  may  lie  either  for  searching  for  or 
seizing  such  materials.  Thus  even  a  temporary  seizure  or  examination  may  result  in  liability', 

19  despite  the  fact  that  such  a  PPA  violation  lies  far  outside  the  scope  of  the  issues  raised  by  the 
Zurcher  decision.  Zurcher  involved  a  search  of  a  newspaper  office,  and  the  warrant  was  drawn 
21  to  intentionally  seize  photographs  that  had  been  made  in  contemplation  of  publicat  ion.  The 

PPA,  designed  to  address  the  Zurcher  decision,  accordingly  should  deter  law  enforcement  from 
2  3  intentionally  searching  for  evidentiary  materials  In  the  possession  of  innocent  third  parties 

engaged  in  information  dissemination.  But  making  unlawful  the  reasonable  but  incidental 
25  seizure  of  PPA-protected  materials  pursuant  to  an  otherwise  lawful  search  or  seizure  carries  no 

similar  deterrent  effect,  and  it  contravenes  the  clearly  stated  intent  of  Congress  to  neither  shield 
27  criminals  nor  unduly  hinder  law  enforcement  efforts. 


3 1  The  potential  —  and  unpredictable  —  liability  inadvertently  created  by  the  PPA  has 

inhibited  the  investigation  and  prosecution  of  crimes  committed  using  computers.  For  example, 
3  3  individuals  have  used  computers  to  distribute  child  pornography,  copyrighted  software,  and 

stolen  credit  card  numbers  over  ordinary  phone  lines  and  the  Internet.  Some  of  these  individuals 
3  5  have  attempted  to  use  the  PPA  to  shield  their  illegal  activities  by  intentionally  storing  PPA- 

protected  materials  on  the  same  storage  devices  that  they  use  for  their  illegal  activities.  Indeed, 

3  7  law  enforcement  agents  have  encountered  individuals  using  computers  for  illegal  activities  that 
have  posted  the  following  message  on  their  sign-on  screens: 


No  court  has  vet  held  that  an  electronic  message,  posted  for  viewing  by  the  general  public  bv  way 
of  a  Bulletin  Board  System  or  the  Internet,  constitutes  a  “similar  tom  of  public  communication*  to  newspapers, 
books,  and  broadcasts  under  the  PPA.  Although  the  instant  amendments  to  the  PPA  do  not  opine  on  this  subject,  a 
court  might  make  this  ruling  if  presented  with  the  right  facts 
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NOTICE  TO  LAW  ENFORCEMENT  AGENTS: 

The  owners  and  users  of  this  system  are  exercising  First  Amendment  Rights _ 

Some  material  on  thus  system  is  in  preparation  for  public  dissemination  and  is 
"work  product  material"  protected  under  the  First  Amendment  Privacy  Protection 
Act  of  1980 ....  Each  and  every  person  who  has  such  "work  product  material" 
stored  on  this  system  is  entitled  to  recover  at  least  minimum  damages  of  $1000 

*plus  all  legal  expenses* _ While  the  agency  you  work  for  *  might*  pay  your 

legal  fees  .and  judgments  against  you,  why  take  chances? 


The  language  "[sjorae  material  on  this  system"  is  extremely  significant.  It  is  seldom  the  case 
that  a  computer  is  used  solely  for  illegal  purposes  such  as  the  distribution  of  contraband.  Were 
this  the  case,  the  computer  and  the  evidence  it  contains  could  be  seized  without  regard  to  the 
PPA,  since  contraband  is  specifically  excluded  from  the  definitions  of  work  product  and 
documentary  materials.  42  U.S.C.  §  2Q0Gaa-7(a)  (defining  "documentary  materials");  42  U.S.C. 
§  2000aa-7(b)  (defining  "work  product  materials").  In  most  cases,  only  certain  portions  of  a 
website  or  electronic  bulletin  board  will  be  set  aside  for  illegal  activities,  while  other  portions  are 
used  for  completely  legal  activities  such  as  the  legitimate  distribution  of  information.  As  the 
quoted  language  makes  clear,  however,  criminals  are  well  aware  that  under  the  PPA,  protected 
materials  can  be  used  to  shield  contraband  from  search  and  seizure.  Congress,  of  course,  never 
intended  to  shield  contraband  when  it  enacted  the  PPA. 

Moreover,  in  addition  to  exposing  law  enforcement  to  unintended  liability,  the  PPA,  as  it 
stands,  creates  unnecessary  problems  during  the  execution  of  warrants,  problems  that  potentially 
harm  the  health  and  safety'  of  the  public.  In  1999,  for  example,  Special  "Agents  of  the  Federal 
Bureau  of  Investigation  uncovered  a  system  of  computers  used  to  proride  child  pornography  to 
anyone  with  access  to  the  Internet.  These  computers,  however,  also  provided  Internet  accounts 
to  third  parties,  many  of  whom  did  not  know  about  the  illegal  activities  of  the  computers’ 
operators.  These  unrelated  accounts  may  have  contained  material  protected  by  the  PPA.  The 
investigators  determined  that  it  would  be  impossible  to  search  the  computers  on  site  while  at  the 
same  rime  allowing  the  computers  to  continue  to  operate.  Thus,  in  an  effort  to  reduce  their 
potential  liability  under  the  PPA  for  seizing  the  third  party  accounts,  the  investigators  decided  to 
obtain  a  search  warrant  authorizing  them  only  to  copy  the  computers’  stored  data  and  allow  the 
computers  to  continue  to  operate.  This,  of  course,  had  the  effect  of  allowing  the  child 
pornography  to  remain  accessible  to  the  public  —  and  possibly  even  allowing  the  pomographers 
or  their  confederates  to  copy  the  images  to  an  unknown  computer  —  while  computer  experts 
reviewed  the  data  to  segregate  the  illegal  files.  Congress  never  intended  to  hamper  law 
enforcement  efforts  in  this  way. 


41  (d)  The  solution 


43 


While  the  PPA  must  be  amended  so  that  it  does  not  shield  child  pomographers, 
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1  the  PPA.7 

3  Additionally,  of  course,  the  link  between  the  incidental  items  and  the  lawful  object  of  the 

search  or  seizure  must  be  reasonable  on  the  facts  of  the  case.  This  requir  ement  that  such  a 
5  search  be  reasonable  is  directly  analogous  to  the  Fourth  Amendment  requirement  of 

reasonableness  both  in  the  scope  of  a  search  warrant  and  in  its  execution.  See  O'Connor  v. 

7  Ortega,  480  U.S.  709,  726  (1987);  United  States  v.  Henson.  848  F,2d  1374  (6th  Or.  1988); 

United  States  v.  Tamura.  694  F.2d  591  (9th  Cm  1982).  Cases  that  have  nothing  to  do  with  the 
9  PPA  have  caused  courts  to  wrestle  with  whether,  under  all  the  facts  and  circumstances,  seizing 
certain  incidentai  materials  was  sufficiently  reasonable  to  meet  the  Fourth  Amendment  standard. 
11  Thus,  'the'ameridmenis  do  not,  by  any  means,  invite  law  enforcement  to  use  "an  otherwise 
lawful"  search  as  a  pretext  for  an  unreasonable  rummaging  of  other  do  cuments  —  whether 
13  protected  by  the  PPA  or  not.  On  the  contrary,  this  new  exception  to  the  PPA  will  allow  courts  to 
apply  existing  and  well-established  Fourth  Amendment  jurisprudence  in  analyzing  the  analogous 
15  question  of  whether  arty  incidental  search  or  seizure  of  PPA-protected  materials  has  been 
reasonable  under  the  circumstances. 

17 


7  This  provision  docs  not,  of  course,  require  that  die  incidental  seizure  of  protected  materials  be 
inadvertent:  law  enforcement  oSlcers  may  knowingly  seize  protected  materials  where  such  seizure  is  incidental  so  a 
lavvtui  search. 
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Executive  Summary 


Amendments  Creating  a  “Clean  Hands’’  Exception  to  Provisions  Statutorily  Mandating  the 
Suppression  of  Illegally  Intercepted  Communications. 


The  accompanying  amendments  would  create  a  “dean  hands”  exception  to  the  statutory 
suppression  mandates  of  IS  U.S.C.  §2515  governing  the  use  and  introduction  of  illegally 
intercepted  wire  or  oral  communications.  The  proposal  would  allow  for  the  use  in  a  criminal 
investigation  and  the  introduction  into  evidence  in  criminal  matters  of  communications 
otherwise  illegally  intercepted  by  persons  other  than  law  enforcement,  ONLY  if  law  enforcement 
was  neither  directly  or  indirectly  involved  in  its  acquisition.  Not  unlike  the  rationale  supporting 
the  “good  faith”  exception  to  the  Fourth  Amendment’s  exclusionary  remedies,  implicit  in  the 
proposed  amendment  is  the  determination  that  the  truth-finding  functions  of  the  criminal  process 
are  paramount  when  there  is  little  or  no  law  enforcement  deterrence  effect  achievable.  In 
contrast  to  existing  law  which  prohibits  ail  use,  the  proposed  amendment  would  allow  the 
introduction  of  such  evidence  both  when  it  is  inculpatory  or  exculpatory  in  nature. 
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“Clean  Hands”  Exception  to  Statutory  exclusionary  Rule 

(Exclusive  of  Other  Substantive  Amendments) 

Section  25 1 5.  Prohibition  of  use  as  evidence  of  intercepted  wire  or  oral  communications 

(a)  Exbept  a^gt^yj^ed  msubsectlpa  Wheaevee  any  or  oral  communication 

has  been  intercepted,  no  part  of  the  contents  of  such  communication  and  no  evidence  derived 
therefrom  may  be  received  in  evidence  in  any  trial,  bearing,  or  other  proceeding  in  or  before  any 
court,  grand  jury,  department,  officer,  agency,  regulatory  body,  legislative  committee,  or  other 
authority  of  the  United  States,  a  States  or  a  political  subdivision  thereof  if  the  disclosure  of  that 
information  would  be  in  violation  of  this  chapter. 


. 


Section  2  517.  Authorization  for  disclo  sure  and  use  of  intercepted  wire,  oral,  or  electronic 
communications 

(1)  Any  investigative  or  law  enforcement  officer  who,  by  any  means  authorized  by  this  chapter 

has  obtained  knowledge  of  the  con  tents  of 

any  wire,  oral,  or  electronic  communication,  or  evidence  derived  therefrom,  may  disclose  such 
contents  to  another  investigative  or  law  enforcement  officer  to  the  extent  that  such  disclosure  is 
appropriate  to  the  proper  performance  of  the  official  duties  of  the  officer  making  or  receiving  the 
disclosure. 

(2)  Any  investigative  or  law  enforcement  officer  who,  by  any  means  authorized  by  this  chapter 

has  obtained  knowledge  of  the  contents  of 

any  wire,  oral,  or  electronic  communication  or  evidence  derived  therefrom  may  use  such 
contents  to  the  extent  such  use  is  appropriate  to  the  proper  performance  of  his  official  duties, 

(3)  Any  person  who  has  received,  by  any  means  authorized  by  this  chapter,  any  information 
concerning  a  wire,  oral,  or  electronic  communication,  or  evidence  derived  therefrom  intercepted 
in  accordance  with  the  provisions  of  this  chapter  may  disclose  the  contents  of  that 
communication  or  such  derivative  evidence  while  giving  testimony  under  oath  or  affirmation  in 
any  proceeding  held  under  the  authority  of  the  United  States  or  of  any  State  or  political 
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(4)  No  otherwise  privileged  wire,  oral,  or  electronic  communication  intercepted  in  accordance 
with,  or  in  violation  of,  the  provisions  of  this  chapter  shall  lose  its  privileged  character, 

(5)  When  an  investigative  or  law  enforcement  officer,  while  engaged  in  intercepting  wire,  oral, 
or  electronic  communications  in  the  manner  authorized  herein,  intercepts  wire,  oral,  or  electronic 
communications  relating  to  offenses  other  than  those  specified  in  the  order  of  authorization  or 
approval,  the  contents  thereof  and  evidence  derived  therefrom,  may  he  disclosed  or  used  as 
provided  in  subsections  (I)  and  (2)  of  this  section.  Such  contents  and  any  evidence  derived 
therefrom  may  be  used  under  subsection  (3)  of  this  section  when  authorized  or  approved  by  a 
judge  of  competent  jurisdiction  where  such  judge  finds  on  subsequent  application  that  the 
contents  were  otherwise  intercepted  in  accordance  with  the  provisions  of  this  chapter.  Such 
application  shall  be  made  as  soon  as  practicable. 


Section  25 1 8.  Procedure  for  interception  of  wire,  oral,  or  electronic  communications 

(1)  Each  application  for  an  order  authorizing  or  approving  the  interception  of  a  wire,  oral,  or 
electronic  communication  under  this  chapter  shall  be  made  in  writing  upon  oath  or  affirmation  to 
a  judge  of  competent  jurisdiction  and  shall  st  ate  the  applicant's  authority  to  make  such 
application.  Each  application  shall  include  the  following  information: 

(a)  the  identity  of  the  investigative  or  law  enforcement  officer  making  the  application, 
and  the  officer  authorizing  the  application; 

(b)  a  mil  and  complete  statement  of  the  facts  and  circumst  ances  relied  upon  by  the 
applicant,  to  justify  his  belief  that  an  order  should  be  issued,  including  (i)  details  as  to  the 
particular  offense  that  has  been,  is  being,  or  is  about  to  he  committed,  (ii)  except  as 
provided  in  subsection  (1 1),  a  particular  description  of  the  nature  and  location  of  the 
facilities  from  which  or  the  place  where  the  communication  is  to  be  intercepted,  (hi)  a 
particular  description  of  theftype  of  communications  sought  to  be  intercepted,  (iv)  the 
identity  of  the  person,  if  known,  committing  the  offense  and  whose  communications  are 
to  be  intercepted; 

(c)  a  full  and  complete  statement  as  to  whether  or  not  other  investigative  procedures  have 
been  tried  and  failed  or  why  they  reasonably  appear  to  be  unlikely  to  succeed  if  tried  or 
to  be  too  dangerous; 

(d)  a  statement  of  the  period  of  time  for  which  the  interception  is  required  to  be 
maintained.  If  the  nature  of  the  investigation  is  such  that  the  authorization  for 
interception  should  not  automatically  terminate  when  the  described  type  of 
communication  has  been  first  obtained,  a  particular  description  of  facts  establishing 
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probable  cause  to  believe  that  additional  communications  of  the  same  type  will  occur 
thereafter; 

(e)  a  full  and  complete  statement  of  the  facts  concerning  all  previous  applications  known 
to  the  individual  authorizing  and  making  the  application,  made  to  any  judge  for 
authorization  to  intercept,  or  for  approval  of  interceptions  of,  wire,  oral,  or  electronic 
communications  involving  any  of  the  same  persons,  facilities  or  places  specified  in  the 
application,  and  the  action  taken  by  the  judge  on  each  such  application;  and 

(f)  where  the.application  is  for  the  extension  of  an  order,  a  statement  setting  forth  the 
results  thus  far  obtained  from  the  interception,  or  a  reasonable  explanation  of  the  failure 
to  obtain  such  results, 

(2)  The  judge  may  require  the  applicant  to  furnish  additional  testimony  or  documentary  evidence 
in  su  pport  of  the  application, 

(3)  Upon  such  application  the  judge  may  enter  an  ex  parte  order,  as  requested  or  as  modified, 
authorizing  or  approving  interception  of  wire,  oral,  or  electronic  communications  within  the 
territorial  jurisdiction  of  the  court  in  which  the  judge  is  sitting  (and  outside  that  juri  sdiction  but 
within  the  United  St  ates  in  the  case  of  a  mobile  int  erception  device  authorized  by  a  Federal  court 
within  such  jurisdiction),  if  the  judge  determines  on  the  basis  of  the  facts  submitted  by  the 
applicant  that— 

(a)  there  is  probable  cause  for  belief  that  an  individual  is  committing,  has  committed,  or 
is  about  to  commit  a  particular  offense  enumerated  in  section  2516  of  this  chapter; 

i 

(b)  there  is  probable  cause  for  belief  that  particular  communications  concerning  that 
offense  will  be  obtained  through  such  interception; 

(c)  normal  investigative  procedures  have  been  tried  and  have  failed  or  reasonably  appear 
to  be  unlikely  to  succeed  if  tried  or  to  be  too  dangerous; 

(d)  except  as  provided  in  subsection  (1 1),  there  is  probable  cause  for  belief  that  the 
facilities  from  which,  or  the  place  where,  the  wire,  oral,  or  electronic  communications  are 
to  be  intercepted  are  being  used,  or  are  about  to  be  used,  in  connection  with  the 
commission  of  such  offense,  or  are  leased  to,  listed  in  the  name  of,  or  commonly  used  by 
such  person, 

(4)  Each  order  authorizing  or  approving  the  interception  of  any  wire,  oral,  or  electronic 
communication  under  this  chapter  shall  specify— 

(a)  the  identity  of  the  person,  if  known,  whose  communications  are  to  be  intercepted; 
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(b)  the  nature  and  location  of  the  communications  facilities  as  to  which,  or  the  place 
where,  authority  to  intercept  is  granted, 

(c)  a  particular  description  of  the  type  of  communication  sought  to  be  intercepted,  and  a 
statement  of  the  particular  offense  to  which  it  relates; 

(d)  the  identity  of  the  agency  authorized  to  intercept  the  communications,  and  of  the 
person  authorizing  the  application;  and 

(e)  the  period,  of  time  during  which  such  interception  is  authorized,  including  a  statement 
as  to  whether  or  not  the  interception  shall  automatically  terminate  when  the  described 
communication  has  been  first  obtained 

An  order  authorizing  the  interception  of  a  wire,  oral,  or  electronic  communication  under  this 
chapter  shall,  upon  request  of  the  applicant,  direct  that  a  provider  of  wire  or  electronic 

f  ^ ve*  lai^0rdLaiSt?dian  or  other  ^rsQn  shaH  ^sh  the  applicant  forthwith 
au  miormation,  facilities,  and  technical  assistance  necessary'  to  accomplish  the  interception 

unobtrusively  and  with  a  minimum  of  interference  with  the  services  that  such  service  provider 
n  or  ,  custodian,  or  person  is  according  the  person  whose  communications  are  to  be 
intercepted.  Any  provider  of  wire  or  electronic  communication  service,  landlord,  custodian  or 
other  person  tailing  such  facilities  or  technical  assistance  shall  be  compensated  therefor  bv 
B  e  app  icant  ^0r  reasona^^e  exPenses  tocurred  in  providing  such  facilities  or  assistance, 
ursuant  to  section  2522  of  this  chapter,  an  order  may  also  be  issued  to  enforce  the  assistance 
capability  and  capacity  requirements  under  the  Communications  Assistance  for  Law 
Enforcement  Act. 

(5)  No  order  entered  under  this  section  may  authorize  or  approve  the  interception  of  any  wire 
oral,  or  electronic  communication  for  any  period  longer  than  is  necessary-  to  achieve  the 
objective  of  the  authorization,  nor  in  any  event  longer  than  thirty  days.  Such  thirty-day  perio  d 
begins  on  the  earlier  of  the  day  on  which  the  investigative  or  law  enforcement  officer  first  begins 

oXiSv “f"  ""  °*r  ^  aft'r  ,he  or<ier  is  Extensions  of  an 

may  be  granted,  but  only  upon  application  for  an  extension  made  in  accordance  with 

^  sectional)  of  this  section  and  the  court  making  the  findings  required  by  subsection  (3)  of  this 

TIT  Pen°d  of  ef  ™  shaiI  be  »  ^nger  the  authorizing  judge  deems  necessary 

p  achjevJ the  Purposes  for  which  it  was  granted  and  in  no  event  for  longer  than  thirty  days 
Every  order  and  extension  thereof  shall  contain  a  provision  that  the  authorization  to  intercom 
,  be  executed  as  soon  as  practicable,  shall  be  conducted  in  such  a  way  as  to  minimize  the 
interception  of  communications  not  otherwise  subject  to  interception  under  this  chapter  and 
must  terminate  upon  attainment  of  the  authorized  objective,  or  in  any  event  in  thirty  davs  In  t  he 
event  the  intercepted  communication  is  in  a  code  or  foreign  language,  and  an  expert  in  that 
oreip  language  or  code  is  not  reasonably  available  during  the  interception  period,  minimization 
may  be  accomplished  as  soon  as  practicable  after  such  interception.  An  interception  under  this 
chapter  may  be  conducted  m  whole  or  in  part  by  Government  personnel,  or  bv  an  individual 
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operating  under  a  contract  with  the  Government,  acting  under  the  supervision  of  an  investigative 
or  law  enforcement  officer  authorized  to  conduct  the  interception. 


require  repons  to  be  made  t  o  the  judge  who  issued  the  order  showing  what  progress  has  been 
made  toward  achievement  of  the  authorized  objective  and  the  need  for  cont  inued  interception. 
Such  reports  shall  be  made  at  such  intervals  as  the  judge  may  require. 

(/)  Notwithstanding  any  other  provision  of  this  chapter,  any  investigative  or  law  enforcement 
officer,  specially  designated  by  the  Attorney  General,  the  Deputy  Attorney  General,  the 
Associate  Attorney  General  or  by  the  principal  prosecuting  attorney  of  anv  State  or  subdivision 
thereof  acting  pursuant  to  a  statute  of  that  State,  who  reasonably  d  etermines  that- 


(a)  an  emergency  situation  exists  that  involves— 

(i)  immediate  danger  of  death  or  serious  physical  injury  to  any  person, 

(ii)  conspiratorial  activities  threatening  the  national  security  interest,  or 
(id)  conspiratorial  activities  characteristic  of  organized  crime 

that  requires  a  wire,  oral,  or  electronic  communication  to  be  intercepted  before  an  order 
authorizing  such  interception  can,  with  due  diligence,  be  obtained,  and 

(b)  there  are  grounds  upon  which  an  order  could  be  entered  under  this  chapter  to 
authorize  such  interception. 


may  intercept  such  wire,  oral,  or  electronic  communication  if  an  application  for  an  order 
approving  the  interception  is  made  in  accordance  with  this  section  within  forty-eight  hours  after 
to  interception .has  ocean*  or  begins  to  occur,  lo  to  abseoce  of  anord^  suSSta 
shall  immediately  terminate  when  the  communication  sought  is  obtained  or  when  the  anplicaticn 

orr;™Zc  S,  WhitheW  iS  b  lhe  Sucb  w"rad0'> for  wraval  is  denied. 

rA  'h  case  where  the  Perception  is  terminated  without  an  order  having  been  issued  the 

contents  of  any  wire,  oral,  or  electronic  communication  intercepted  shall  be  treated  as  having’ 
seen  ob  tained  in  violation  of  this  chapter,  and  an  inventory  shall  be  served  as  provided  for  in' 

subsection  |||(d)  of  this  section  on  the  person  named  in  the  application, 

(a)  The  contents  of  any  wire,  oral,  or  electronic  communication  intercepted  by  anv  mean  s 
authorized  by  this  chapter  shall,  if  possible,  be  recorded  on  tape  or  wire  or  other  " 
comparable  device.  The  recording  of  the  contents  of  any  wire,  oral,  or  electronic 
communication  under  this  subsection  shall  be  done  in  such  way  as  will  protect  the 
recording  from  editing  or  other  alterations,  immediately  upon  the  expiration  of  the 
period  of  the  order,  or  extensions  thereof,  such  recordings  shall  be  made  available  to  the 
judge  issuing  such  order  and  sealed  under  his  directions.  Custody  of  the  recordings  shall 
be  wherever  the  judge  orders.  They  shall  not  be  destroyed  except  upon  an  order  of  the 
issuing  or  denying  judge  and  in  any  event  shall  be  kept  for  ten  years.  Duplicate 
recordings  may  be  made  for  use  or  disclosure  pursuant  to  the  provisions  of  subsections 


(8) 
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3.  (1)  and  (2)  of  section  2517  of  this  chapter  for  investigations.  The  presence  of  the  seal 

provided  for  by  this  subsection,  or  a  satisfactory  explanation  tor  the  absence  thereof, 

3  shall  be  a  prerequisite  for  the  use  or  disclosure  of  the  contents  of  any  wire,  oral,  or 

electronic  communication  or  evidence  derived  therefrom  under  subsection  (3)  of  section 
5  2517. 


7 

9 


11 


13 


IS 


17 


19 

21 

23 

25 

27 

29 


31 


33 

35 

37 

39 

41 


(b)  Applications  made  and  orders  granted  under  this  chapter  shall  be  sealed  by  the  judge. 
Custody  of  the  applications  and  orders  shall  he  wherever  the  judge  directs.  Such 
applications  and  orders  shall  be  disclosed  only  upon  a  showing  of  good  cause  before  a 

.  judge  of  competent  jurisdiction  and  shall  not  be  destroyed  except  on  order  of  the  issuing 
or  denying  judge,  and  in  any  event  shall  be  kept  for  ten  years. 

(c)  Any  violation  of  the  provisions  of  this  subsection  may  be  punished  as  contempt  of  the 
issuing  or  denying  judge. 

(d)  Within  a  reasonable  time  but  not  later  than  ninety  days  after  the  filing  of  an 
application  for  an  order  of  approval  under  section  2538(7)(b)  which  is  denied  or  the 
temunation  of  the  period  of  an  order  or  extensions  thereof  the  issuing  or  denying  judge 
shall  cause  to  be  served,  on  the  persons  named  in  the  order  or  the  application,  and  such 
other  parties  to  intercepted  communications  as  the  judge  may  determine  tn  Ms  discretion 
that  is  in  the  interest  of  justice,  an  inventory  which  shall  Include  notice  of~~ 

(1)  the  fact  of  the  entry  of  the  order  or  the  application; 

(2j  the  date  of  the  entry  and  the  period  of  authorized,  approved  or  disapproved 
interception,  or  the  deni  al  of  the  application;  and 

(3)  the  fact  that  during  the  period  wire,  oral,  or  electronic  communications  were 
or  were  not  intercepted. 

The  judge,  upon  the  filing  of  a  motion,  may  in  his  discretion  make  available  to  such  person  or  his 
counsel  for  inspection  such  portions  of  the  intercepted  communications,  applications  and  orders' 
as  the  judge  determines  to  be  in  the  interest  of  justice.  On  an  ex  parte  showing  of  good  cause  to 

a  judge  of  competent  jurisdiction  the  serving  of  the  inventory  required  by  this  subsection  mav  be 
postponed. 

(9)  The  contents  of  any  wire,  oral,  or  electronic  communication  intercepted  pursuant  to  this 
chapter  or  evidence  derived  therefrom  shall  not  be  received  in  evidence  or  otherwise  disclosed  in 
any  trial,  hearing,  or  other  proceeding  in  a  Federal  or  State  court  unless  each  party,  not  less  than 
ten  days  before  the  trial,  hearing,  or  proceeding,  has  been  furnished  with  a  copy  of  the  court 
order,  and  accompanying  application,  under  which  the  interception  was  authorized  or  approved. 
This  ten-day  period  may  be  waived  by  the  judge  ifhe  finds  that  it  was  not  possible  to  furnish  the 
party  with  the  above  information  ten  days  before  the  trial,  hearing,  or  proceeding  and  that  the 
party  will  not  be  prejudiced  by  the  delay  In  receiving  such  information. 


(10)  (a)  Any  aggrieved  person  in  any  trial,  hearing,  or  proceeding  in  or  before  any  court. 
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department,  officer,  agency,  regulatory  body,  or  other  authority'  of  the  United  States,  a 
State,  or  a  political  subdivision  thereof,  may  move  to  suppress  the  contents  of  any  wire  or 

oral  communication  intercepted  pursuant  to  this  chapter,  or  evidence  derived  therefrom 
on  the  grounds  that-  " . ? 

(i)  the  communication  was  unlawfully  intercepted; 

(ii)  the  order  of  authorization  or  approval  under  which  it  was  intercepted  is 
insufficient  on  its  face;  or 


(iii)  the  interception  was  not  made  in  conformity  with  the  order  of  authorization 
or  approvafc§ 

^ ^  £d^oJn  sltali^e  masde  ^forJ^^S^^aring^'^r  proceSn|^i23£e 

was  no  opportunity  to  make  such  motion  or  the  person  was  not  aware  of  the  grounds  of 
the  motion.  If  the  motion  is  graated,|the  contents  of  the  intercepted  wire  or  oral 
communication,  or  evidence  derived  therefrom,  shall  be  treated  as  having  been  obtained 
in  violation  of  this  chapter.  The  judge,  upon  the  filing  of  such  motion  by  the  aggrieved 
person,  may  m  his  discretion  make  available  to  the  aggrieved  person  or  Ms  counsel  for 
inspection  such  portions  of  the  intercepted  communication  or  evidence  derived  therefrom 
as  the  judge  determines  to  be  in  the  interests  of  justice. 


(b)  In  addition  to  any  other  right  to  appeal,  the  United  States  shall  have  the  right  to 
appeal  from  an  order  granting  a  motion  to  suppress  made  under  paragraph  (af  of  this 
subsection,  or  the  denial  of  an  application  for  an  order  of  approval,  if  the  United  States 
attorney  shall  certify  to  the  judge  or  other  official  granting  such  motion  or  denying  such 
application  that  the  appeal  is  not  taken  for  purposes  of  delay.  Such  appeal  shall  be  taken 
within  thirty  days  after  the  date  the  order  was  entered  and  shall  be  diligently  prosecuted. 


(g  The  remedies  and  sanctions  described  in  this  chapter  with  respect  to  the  interception 
or  electronic  communications  are  the  only  judicial  remedies  and  sanctions  for  non¬ 
constitutional  violations  of  this  chapter  involving  such  communications. 
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“Clean  Hands”  Exception  Proposed  Legislative  History 

Inapplicability  of  18  US,C.  §2515  statutory  exclusion  and  non-use  of  certain  “clean 
hands”  good  faith  disclosures 

This  proposed  change  makes  a  carefully  limited  amendment  of  18  U  S  C  §?51  5  the 
statutory  exclusionary-  rule  for  violations  of  Title  Hi  of  the  Omnibus  Crime  Controfand  Safe 
Streets  Act  of  1968,  so  as  clearly  to  exempt  two  situations:  (1)  those  in  which  private  individuals 
illegally  intercept  or  record  a  communication,  but  the  recording  later  comes  into  the  possession 
or  a  party  m  a  comma!  trial,  who  then  wishes  of  introduce  it;  and  (2)  those  in  which  an 

Iwa*  'v'101ateS,ehapt5  1 19  {e  g\> by  ^ging  in  an  illegal  wiretap)  and  the  government 
tnereatter  seeks  of  use  the  communication  to  prosecute  that  violator. 

At  present,  appellate  decisions  are  in  apparent  conflict  over  whether  section  2515 
f^ZVbe  T  ofco“cfons>  *e  category  described  above.  Under  one  possible 
cfaTii!  ?”?-  ^Ctl0n,7'  ■; lfa  PnJ3te  individual  consensu  ally  records  a  conversation  in  aid 
of  an  illegal  activity,  or  illegally  records  a  conversation  between  other  parties  without  their 
consent,  the  contents  of  such  recordings  are  not  admissible  in  a  criminal  trial  or  hearing  even  if 
government  had  no  role  m  having  the  evidence  recorded  and  only  acquired  it,  through  lawful 

not *  iv  er  A  ?  SIt?f 0n  0CCUrS  because> under  !S  US  C-  §25 1  K2){d).  a  consenting 

§  Under^l0r  0f  ,aw>  may  record  on3y  tf  the  wording  is  for  a  non-criminal  or  ~ 

she  oamhUehZ°Sf'  °f*  bribe  SeCretly  records  ^  Action  in  which  he  or 

h  a  ScV^ffi  f  f  l  *?•  f6  S°Vemment  latCr  obtaks  t5ie  recordiaS  seeks  of  use 

fcamst  the  official  of  prove  the  bnbe,  section  2515  arguably  precludes  such  use.  One 

appellate  court  has  so  held.  United  States  v.  Vest  813  F.2d  477  (1st  Cir.  1987) 

By  contrast,  another  appellate  court  has  held  that  section  2515  does  not  bar  the 
fr°m  Wordings  made  by  an  business  (of  bets  placed  by 

™th  bett0rs  °ver  **  of  their  bets.  United  States  v 

Lndgrh^i,  8b  F.2d  105  (6th  Cir.),  pert,  denied,  484  U.S.  821,  846  (1987).  While  the  court  in 
Vest  acknowledged  that  no  deterrent  purpose  would  be  served  by  suppression  because  the 

th,«fcf  k 5  the  onginal  privacy  eolation.  The  corn  in  Underhill  0„ 

breadth  f  ff  ,e®slati7  his,or>’  <*«•  Congress,  despite  the  facial 

of  section  -515,  did  not  intend  to  permit  lawbreakers  to  immunize  themselves  from 
prosecution  by  the  very  criminal  purposes  that  made  the  recordings  i&enal. 

The  same  disagreement  among  circuit  courts  exists  regarding  the  admissibility  of 

pmietln  nnde  **  ^  afors  'f™ communications  without  the  consent  of  any  of  the 
P  es.  In  one  case,  a  court  barred  the  use  before  a  grand  jury  of  such  illegally  intercepted 

communications.  See  In  re  Grand  Jurv.  m  F3dl066fMr;r  l00?!  tWnm-tr  i  t 

c«*n*t!v  imtatu  ,  7-  T~~- - -  7  1  vir-  iyyU-  ay  contrast,  where  a  wife 

thelmh  r  !  recording  device  to  intercept  her  husband’s  conversations  with  other  persons, 
the  Sixth  Circuit  concluded  that  section  25 1 5  did  not  bar  the  use  of  the  contents  of  those 
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communications  in  a  prosecution  of  the  husband,  given  the  government's  tack  of  involvement  tn 
the  original  interception.  See  United  States  v.  Murdock  63  F.3d  1391  (6&  Cir.  1995). 

WTiether  or  not  Vest  and  In  re  Grand  Jury  were  correctly  decided  under  the  existing 
statutory  provision,  an  exemption  should  be  created  under  section  2515  for  that  narrow  class  of 
cases  in  which  the  government  lawfully  obtains  illegal  recordings  made  by  private  parties  and 
seeks  to  use  them  as  evidence  in  a  criminal  investigation,  proceeding,  hearing  or  trial,  or  before  a 
grand  jury.  The  truth-seeking  function  of  a  criminal  proceeding  is  of  paramount  importance.  In 
the  absence  of  any  det  errent  purpose  to  be  saved  by  exclusion,  this  truth-seeking  function 
should  prevail  over  tire  concern  that  disclosure  in  the  criminal  proceeding  would  somehow 
exacerbate  the  original  illegal  recording. 

Conversely,  if  evidence  contained  in  an  illegally  intercepted  recording  tends  to  exculpate 
a  defendant,  that  defendant  should  be  entitled  to  introduce  the  evidence  so  long  as  he  did  not 
participate  in  the  interception  in  any  way.  The  instant  amendment  thus  reflects  the  belief  that  a 
pnvate  violation  of  the  statute  should  not  trigger  the  severe  result  of  exclusion  of  otherwise 
probative  evidence  k  a  criminal  case  (just  as  the  Fourth  Amendment,  of  course,  does  not  'apply 
to  non-governmental  searches  and  seizures*).  Accordingly,  this  section  would  amend  section  * 
*.-15  to  expressly  exempt  such  disclosures  from  its  purview. 

In  addition,  the  amendment  would  also  darify  that  illegal  intercepts  made  be  used  for  the 
limited  purpose  of  prosecuting  the  individual  who  conducted  the  illegal  interception.  In  one 
recent  case,  United  States  v.  Once,  ^7  F,  Sapp.  2d  428  (D.  S.C.  1998),  an  employee  of  a  county 
snentt  s  department  illegally  intercepted  conversations  between  two  prisoners  and  their 
attorneys.  When  the  United  States  sought  to  use  the  recording  of  prosecute  that  violation,  the 
district  court  ruled  the  evidence  inadmissible.  The  amendment  would  permit  such  use  for  the 
purpose  of  prosecutkg  the  violator  of  chapter  1 19.  Conforming  amendments  are  also  made  of 
subsections  (3  )  and  (2)  of  section  2517  and  subsection  2518(10){a) . 


B 

The  history  of  section  25 1 5’s  original  enactment  makes  clear  that  Congress  intended  that  itanbodv 
ex«ung  Fourth  Amendment  fmdams.  SeeS.  Rep.  No.  1997,  Cong.  2d  &»..  rearimed  in  \96S  US, C  CAN. 
-  t  o  (no  intension  t  press  me  scope  of  the  suppression  role  bey  ond  present  search  and  secure  \m  '\ 
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MATTER  NOT  CONTAINED 
IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 


Emergency  Fen  Register/Trap  and  Trace  authority  at  field  level. 


X 


S/24/02  Release  -  Page  3SS 


Executive  Summary 

Amendment  Creating  Emergency  Pen  Register/Trap  &  Trace  Authority  for  US  Attorneys 
and  Top  Law  Enforcement,  '  * 

Under  current  law,  1 S  U.S.C.  §  3 125(a),  an  emergency  pen  register  or  trap  &  trace  mav 
e  aut  onzed  only  by  certain  high  level  DOI  officials  or  “any  investigative  or  law'  enforcement 
o  cer  specially  designated  by  the  Attorney  General”  or,  In  cases  involving  the  States  the 
equivalent  of  the  County  District  Attorney.  Emergency  pen  register  or  trap  &  trace  orders  are 
authorized  under  section  3125(a)  only  when  there  exists  an  immediate  danger  of  d  eath  or  serious 
odily  injury  to  any  person,  or  where  there  are  conspiratorial  activities  characteristic  of 
organized  crime.  And  this  bill  will  add  two  other  emergency  circumstances  to  bring  the  pen 
register  statute  in  relative  parallel  with  the  wiretap  emergency  provisions  and  to  acknowledge 

mat  attacks  on  certain  government  or  public  computer  infrastructure  could  seriously  endanger 
the  public  health  or  safety.  3  * 

Even  in  emergency  situation,  a  court  order  ratifying  the  use  of  the  pen  regi  ster  or  trap  & 
trace  must  be  sought  and  obtained  within  48  hours.  Since  the  current  statute  authorizes  the 

m  r^Ster  2t  *"  SMe  leVel  by  **  Coiint>’ District  Attorney,  it  has 
been  argued  that  the  current  restncttons  on  emergency  deployment  by  Federal  authorities  are  bv 

comparison,  incongruous,  unnecessarily  restrictive,  cumbersome  and  time  consuming.  Based  ' 
upon  law  enforcement’s  experience,  the  problem  is  especially  acute  in  dynamic  computer 
investigations  where  time  is  frequently  of  the  essence.  The  proposed  amendment  would  in 
addition  to  the  class  of  DOJ  officials  currently  authorized  to  issue  emergency  pen  registers  or 
implement  trap  &  trace,  statutorily  authorized  the  issuance  of  emergency  implementation  upon 
the  request  of  either  a Unjted  States  Attorney  or  te^pal  sup^s^e  iL  enfor^ 


officer  Si'  Umted  *****  Attoraey  or  the  PnnctP**  supervising  law  enforcement 

vests  “  PeaLnfster  or  lrap  and  trace  5fl ««  emergency  situation 

JJ  a«ffionfy  with  the  official  who  is  m  the  best  position  to  assess  the  need  and  propriety  of  use 

en  e  passing  of  mere  minutes  may  mean  the  loss  of  valuable  information,  for  example  in  an 

roSS  f?Uter  attack'  At  the  S3me  tkne’ t&  express  designation  will  continue  to  assure  the 
nsistent  administration  of  law  enforcement  policy  on  the  use  of  pen  registers  and  trap  and 

trace  devices  by  retaining  centralized  responsibility  for  approving  emergency  use  in  a  limited 
number  ot  identifiable  and  politically  accountable  officials.9 


S.  Rep.  Mo.  1097  90th  Cong.  2dSes$.  (19 6$), reprint J in  196SU.S.C.CAN  "MP  ’185  (  amroval 
level  tor  wiretap  applications).  •  J  -  P?TO  *>‘ 

i  nip  ^  Trace 
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Expediting  Emergency  Pen  Register  and  Trap  &  Trace  Implementation 
(Exclusive  of  any  other  Amendments) 

Section  3 1 25.  Emergency  pen  register  and  trap  and  trace  device  installation 

(a)Notwithstanding  any  other  provision  of  this  chapter, -any  investigative  or  law  onforccmuu 
otficcr,  3pcci%  de3igMted  by  the  Attorney  General,  the  Deputy  Attorney  General,  the 


9  mBSm  wKSsm  s§is 

f,™C’paJ  prcfCUtins  att°mey  of  any  State  or  subdivision  thereof  amine  pmS  to  ^statute  of 
tnat  state,  who  reasonably  determines  that— 


Emergency  Pen  Xegister/Trap  &  Trace  Amendment 
Page  2  of  2  Pages 
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MATTER  NOT  CONTAINED 
IN  BILLS  CURRENTLY  UNDER  CONSIDERATION 


Title  IH  Wiretap  Exception  for  the  Interception  of  Unauthorized  Computer  Trespassers 
Only  upon  the  Written  Request  of  the  Owner/operator  of  the  Computer  Syst  em. 
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(Irrespective  of  other  Amendments) 


[18U.S.C.  §2511] 


'fansmiuvs  to  or  from  the  computi  trcsp||p  ** 


[18  U.S.C.  §2510] 

2Slfi5rtS^^&ed  t0‘ togh>  °r  fr°m  3  pf0teaed  computer  becau^rachpeSn  is' 
accessing*  the^stected  computer  without  authorization.  ^  *  " 


m  any 


Computer  Trespasser  Interception  Exception 
Page  1  of  2  Pages 
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Proposed  Legisutiw  b,„ 

T"  E  Hcto»''  eor  Computer  t*™*. 

^SPASSm^^xctnim 
private  electrTend,nerit  ^°WS’  bW  d°eS  not  squire  owners  and 

;  te  eie^tr°njc  or  wire  communication  service  .  °Pmt0tS  <*  ^puMfco, 

^mmunications/tran,m-  •  68  £o  mho™  law  enW* 

«ansm<sswns  of  a  party  nerwn  e«orcemem  to  intercept  rh* 

""*»  *»  *«  0ctmixi  JT* PTO”  or  “■*■*  rto  the  owner  or  one  , 

network  Tfi  >s  ao  unauthorized  ne  pereior  of 

*  tnonzed  use  on  that  computer  system 

““Othorieed^ie  h  P°  ■ md  Ktao^S« tea,  M„  !  *  *”“* 

society  <W  in  their  ooao  JZ  *  P"™' 

0,1  of  the  exception.  *  pnor  written  so  as  to 


Computer  Trespasser^ 


^^nSrot,Exc2p!k)tJ 
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FEDERAL  BUREAU  OF  INVESTIGATION 


Precedence:  DEADLINE  07/21/2000 

To:  Director's  Office 

Laboratory  Division 
Office  of  General  Counsel 


Date:  07/17/2000 

Attn:  Deputy  Director's  Office 

Mr.  Pickard 
Dr .  Kerr 
Mr.  Parkinson 


From: 


Director's  Office 

Office  of  Public  and  Congressional  Affairs 

Congressional  a^MHiaat 


Contact: 


SSAi 


Approved  By:  Pickard  Thomas  J 
Kerr  Donald  M 
Parkinson  Larry  R 
Collin 


Drafted  By: 

Case  ID  # :  62C-MQ- 1077728 


Title:  ACTION  MEMORANDUM : 

HOUSE  JUDICIARY  COMMITTEE; 

CONSTITUTION  SUBCOMMITTEE; 

HEARING  ON  "FOURTH  AMENDMENT  ISSUES  RAISED  BY  THE  FBI'S 
1  CARNIVORE '  PROGRAM " 

07/24/2000 

Synopsis:  The  Constitution  Subcommittee  of  the  will  conduct  a 

hearing  on  Monday,  07/24/2000,  at  1:00  PM,  in  Room  2141  of  the 
Rayburn  House  Office  Building.  The  purpose  of  the  hearing  is  to 
examine  "Fourth  Amendment  issues  raised  by  the  FBI's  'Carnivore' 
program."  Consequently,  the  Subcommittee  has  requested  that 
Laboratory  Division  Director  Dr.  Donald  M.  Kerr  and  General 
Counsel  Larry  R.  Parkinson  appear  on  behalf  of  the  FBI. 

Details:  The  Constitution  Subcommittee  will  conduct  a  hearing  to 
examine  Fourth  Amendment  issues  raised  by  "Carnivore."  The 
Subcommittee  has  preliminarily  advised  that  the  hearing  will  be 
composed  of  two  panels.  The  first  panel  will  have  witnesses  from 
the  U.S.  Department  of  Justice  (DOJ) ,  to  include  the  FBI.  The 
second  panel  will  be  composed  of  individuals  from  private 
industry  and  Internet  privacy  groups.  It  is  anticipated  that 
Deputy  Assistant  Attorney  General  Kevin  DiGregory,  as  well  as 
David  Green  from  CCIPS,  will  represent  the  Department.  The 
specific  private  sector  witnesses  have  not  yet  been  determined. 
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To:  Director’s  Ofl*ice  From:  Director's  0££&^  Office 

of  Public  and  Congressional  Affairs 
Re:  62C-HQ- 1077728,  07/17/2000 


The  Subcommittee  has  requested  that  the  Laboratory 
Division  and  the  Office  of  the  General  Counsel  provide  a  written 
statement  for  the.  official  record  which  the  witnesses  may 
summarize  for  the  Subcommittee.  The  written  statement  must  also 
be  provided  to  the  Subcommittee  on  a  computer  disk  or  through 
email.  These  items  must  be  provided  to  the  Subcommittee  no  later 
than  Friday,  07/21/2000.  A  letter  of  invitation  from  the 
Subcommittee  has  not  yet  been  received. 

LEAD (s)  : 

Set  Lead  1: 

PI RECTOR  1 S  OFF I CE 


AT  WASHINGTON,  PC 

It  is  requested  that  the  Deputy  Director  approve  Dr'. 
Kerr  and  Mr.  Parkinson's  participation  as  witnesses  at  captioned 
hearing . 

APPROVE  _ 

DISAPPROVE  _ _ 

SEE  ME  _ 


Set  Lead  2 : 

LABORATORY 


AT  WASHINGTON-  DC 


It  is  requested  that  the  Laboratory  Division  prepare 
testimony,  with  assistance  from  th^Of^m^o^^eneral  Counsel, 
for  Dr.  Keo^md  provide  it  to  SSA KoomHHl  J>7C 
Extension vHK  &y  COB  07/19/2000,  ^^^e^that^t  may  be 
transmitted  to  PQJ  for  clearance  and  then  to  the  Subcommittee  in 
a  timely  fashion. 


/ 

■f 


2 
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To:  Director's  OfsUce  From:  Director's  Of f L ■,&  Office 

of  Public  and  Congressional  Affairs 
Re:  62C-HQ- 1077728,  07/17/2000 


Set  Lead  3 : 


GENERAL  COUNSEL 

AT  WASHINGTON ,  DC 

It  is  requested  that  the  Office  of  General  Counsel 
assist  the  Laboratory  Division,  as  needed,  in  the  preparation  of 
testimony  for  captioned  hearing. 


Set  Lead  4s 


OFFICE  OF  PUBLIC  AND  CONGRESSIONAL  AFFAIRS , 
CONGRESSIONAL  AFFAIRS  OFFICE 


AT  WASHINGTON.  DC 


The  Congressional  Affairs  Office  will 
appearances  of  Dr.  Kerr  and  Mr.  Parkinson  before 


coordinate 

the 


the 


Subcommittee;  the  approval  of  the  testimony  from  the  Deputy 
Director's  Office;  and  the  voting  of  the  testimony  by  DOJ. 


♦♦ 
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;  INTERCEPTION  OF  E-MAIL 

White  House  Tries  to  Balance 
•  Rights  of  Computer  Users* 
and  Law  Enforcement 

By  STEPHEN  LAB  ATOM 
with  MATT  RICHTEL 

WASHINGTON,  July  17  -  The 
White  House  said  ted  ay  that  it  would 
propose  legislation  to  set  legal  re¬ 
quirements  for  surveillance  in  cy¬ 
berspace  by  law  enforetmerH  au¬ 
thorities  similar  in  some  ways  to 
those  for  telephone  wiretaps. 

Privacy  advocates  and  civil  liber- 
tres  groups  welcomed  some  aspects 
of  the  proposal  but  said  they  re¬ 
mained  alarmed  about  a  new  RBI 
computer  system  that  searches  and 
intercepts  private  e-mail  and  can 
easily  capture  communications  of 
people  not  suspected  of  crimes. 

The  legislative  proposal  w  as  made 
as  the  administration  also  an¬ 
nounced  today  that  it  had  eased  ex¬ 
port  controls  o n  encryption  technol¬ 
ogy*  making  ii  significantly  easier 
lor  American  companies  to  sell  soft¬ 
ware  products  to  the  European 
Union  and  eight  other  trading  part¬ 
ners  that  can  be  used  to  keep  com¬ 
puter  data  and  communications  se¬ 
cure. 

Both  the  electronic  surveillance 
proposal  and  the  export  control 
changes  ate  part  of  a  broader  policy 
outlined  in  a  speech  today  by  John  D, 
Podesta.  the  White  House  chief  of 
staff.  He  said  the  policy  tries  to  bal¬ 
ance  the  privacy  rights  of  computer 
tisers  against  the  needs  of  law  en¬ 
forcement  to  be  able  to  monitor  digi¬ 
tal  communications. 

Congress  and  federal  regulators 
have  done  little  work  in  the  area, 
even  as  the  world  has  quickly  come 
to  rely  heavily  on  communications 
through  cyberspace-  More  than  1.4 
billion  e-mail  messages  change 
hands  every  day. 


The  administration's  legislative 
proposal  on  electronic  surveillance 
tries  to  fix  the  inconsistent  patch- 
work  of  laws  that  apply  different 
standards  to  telephone,  cable  and 
other  technologies  with  a  single 
standard  for  those  systems  and  the 
Internet  Prospects  for  the  proposal 
in  Congress  are  uncertain. 

Until  now,  law  enforcement  agen¬ 
cies  have  been  able  to  monitor  elec¬ 
tronic  communication  with  only 
modest  court  supervision. 

The  proposed  legislation  would  re¬ 
quire  that  the  same  standards  that 
apply  to  the  interception  of  the  con¬ 
tent  of  telephone  calls  apply  to  the 
interception  of  e-jnali  messages.  Spe¬ 
cifically,  ii  would  retire  law  en- 
forcemem  agents  to  demonstrate 
that  they  have  probable  cause  of  a 
crime  to  obtain  a  court  order  seeking 
the  contents  of  a  suspect's  e-mail 
messages. 

The  proposal  would  also  give  fed¬ 
eral  magistrates  greater  authority  to 
review  requests  by  law  enforcement 


authorises  for  so-called  pen  regis¬ 
ters  —  lists  of  the  phone  numbers 
called  from  a  particular  location  and 
the  time  of  the  calls.  The  magistrates 
now  ha  ve  no  authority  to  question  the 
request  for  such  lists,  which  are  fre¬ 
quently  used  by  die  authorities, 
v  in  the  context  of  the  Internet,  ex¬ 
isting  laws  are  ambiguous  about 
what  standards  apply  for  different 
kinds  of  surveillance.  Many  limita¬ 
tions  imposed  on  law  enforcement  in 
the  context  of  telephone  wiretaps  — 
like  the  requirement  that  such  taps 
be  approved  at  the  highest  level  of 
the  Justice  Department  —  do  not 
appear  to  apply  to  e-mail  surveil¬ 
lance 

Moreover,  the  Cable  Act  of  ISS4 
sets  a  far  harder  burden  for  govern¬ 
ment  agents  to  satisfy  when  trying  to 
monitor  computers  using  cable  mo¬ 
dems  than  when  monitoring  lek- 
phones  That  has  proved  trouble¬ 
some  for  law  enforcement  authors 
ties  as  more  Americans  begin  to  use 
high-speed  Internet  service  through 
cable  networks.  The  Cable  Act  also 
requires  that  the  target  of  the  sur¬ 
veillance  be  given  notice  and  m  op- 


Concern  that  the 
proposals  allow 
federal  agents  too 
much  leeway. 


ponunity  to  challenge  the  request. 


"It's  time  to  update  md  harmo¬ 
nize  our  existing  law's  to  give  all 
forms  of  technology  the  same  legis¬ 
lative  protections  as  our  telephone 
conversations/’  Mr.  Fodesta  said  in 
a  speech  a!  the  National  Press  Club. 
"Our  proposed  legislation  would  bar* 
momie  the  legal  standards  that  ap¬ 
ply  to  law  enforcement's  access  to  e- 
mails,  telephone  calls  and  cable 
services" 

White  House  officials  said  today 
that  they  hoped  the  proposal  would 
break  a  logjam  in  Congress  where  a 
variety  of  different  measures  have 
been  introduced  dealing  with  elec¬ 
tronic  surveillance.  The  administra¬ 
tion's  proposal  adopts  seme  ele¬ 
ments  of  both  Democratic  and  Re¬ 
publican  bills. 

But  Congressional  aides  said  there 
was  too  little  time  left  in  the  legisla¬ 
tive  session  and  that  the  matter 
would  in  all  likelihood  remain  unre¬ 
solved  until  after  the  next  term  be¬ 
gins,  in  2001. 

Administration  officials  said  the 
proposal  would  apply  io  communica¬ 
tions  that  either  begin  or  end  in  the 
United  Slates.  It  would  not  apply  toe- 
mail  messages  transmitted  entirely 

outside  the  country. 

Privacy  and  civil  liberties  groups 
criticized  the  administration's  pro¬ 
posal  because  it  would  continue  to 
v  perm  it  the  government  to  use  a  new 
surveillance  system  that  the  groups 
say  may  be  used  far  more  broadly 
than  older  technologies,  enabling  fed¬ 
eral  agents  to  monitor  an  unlimited 
amount  of  innocent  communications, 
including  those  of  people  who  are  not 
targets  of  criminal  investigations. 

The  system,  used  by  the  Federal 
Bureau  of  Investigation,  is  called 
Carnivore,  so  named,  agents  say,  be¬ 
cause  it  is  able  to  quickly  get  the 
"meat"  in  huge  quantities  of  e-maii 
messages,  so-called  instant  messag¬ 
ing  and  other  communications  be* 
tween  computers. 

Carnivore  is  housed  in  a  small 
black  box  and  consists  of  hardware 
and  software  that  trolls  for  informs* 
Hem  after  being  connected  to  the  net¬ 
work  of  an  Internet  service  provider. 
Once  Installed,  It  has  the  ability  to 
monitor  ail  of  the  e-mail  on  a  net¬ 
work,  from  the  list  of  what  mall  is 
sent  to  the  actual  contain  of  the  com¬ 
munications. 
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Marcos  C.  Thomas,  secu^Lhief  of 
the  Cyber  Technology  Section  of  the 
F.B.L,  said  the  technology  was  devel-  . 
oped  U  months  ago  by  F.B.l  engi¬ 
neers  and  has  been  used  fewer  than 
25  times.  Mr,  Thomas  said  that  Car¬ 
nivore  had  potentially  broad  capahil- 
hies  and  that  he  understood  the  con¬ 
cerns  of  privacy  groups. 

“It  can  do  a  ton  of  things/'  he  said, 
"‘That's  why  it’s  illegal  to  do  so  with¬ 
out  a  clear  order  f  rom  the  court/* 

He  said  that  mm  Internet  service 
providers  had  cooperated  with  re¬ 
quests  to  use  Carnivore. 

Privacy  groups  and  some  Internet 
sendee  providers  have  been  deeply 
critical  of  the  use  of  Carnivore  be- 
cause,  once  Installed  on  a  network,  it 
permits  the  government  to  take 
whatever  information  it  wants. 
Moreover,  the  government  has  not 
said  what  it  does  with  the  extraneous 
material  iV  gathers  that  is  not  rele- 
vant  to  the  particular  surveillance,  “ 
The  issue  does  not  often  arise  to¬ 
day  with  the  monitoring  of  telephone 
conversations  because  when  a  law  j 
enforcement  authority  wants  to  see  a 
tost  of  telephone  calls  made  by  a 
suspect,  the  agent  gets  an  order  from 
a  magistrate,  presents  the  order  to  a 
telephone  company,  and  the  compa¬ 
ny  then  turns  over  the  list. 

In  at  least  one  instance,  an  Inter-  j 
net  company  did  not  cooperate  so 
readily  with  the  government.  In  De¬ 
cember,  federal  marshals  ap*  j 
preached  the  company  with  a  court  j 
order  permitting  them  to  deploy  a  j 
device  to  register  time,  date  and  l 
source  information  involving  e-mail 
messages  sent  to  and  from  a  speci¬ 
fied  account. 


Trying  to  establish  a 
single  standard  for 
different 
technologies , 


Concerned  the  device  would 
record  broader  information,  the 
company  countered  with  a  compro¬ 
mise:  ft  would  provide  the  govern¬ 
ment  with  the  requested  information 
about  e-mail  senders  and  recipients, 
according  to  Robert  Corn -Revere,  a 
lawyer  for  the  company,  in  recent 
Congressional  testimony.  The  com¬ 
pany  was  later  identified  as  Earth- 
Link,  a  service  provider  with  15  mil-  , 
lion  subscribers. 

Mr.  Corn-Re  vere  said  the  govern¬ 
ment  initially  accepted  the  compro¬ 
mise  but  later  became  dissatisfied 
and  wished  to  use  its  own  device, 
EanhLmk  objected  but  was  over¬ 
ruled  by  a  a  federal  court,  which 
ordered  the  de  vice  deployed. 

Other  Internet  companies  have 
also  been  critical  of  Carnivore. 


William  Lv  Schrader,  ehairrrvf  % 
and  chief  executive  of  PSINet*  a  i £^/ 
jor  commercial  Internet  service  pro¬ 
vider,  said  that  the  system  gave  the 
F,BX  the  ability  to  monitor  e-mail 
messages  of  every  person  on  a  given 
network.  He  said  he  would  refuse  to 
permit  the  government  to  use  the 
technology  at  PSINet  unless  2  gems 
could  prove  that  it  could  only  sift  out 
the  traffic  from  a  given  individual 
that  is  the  target  of  a  court  order. 

'■|  object  to  American  ci tiaern  and 
any  citizens  of  the  world  always  be¬ 
ing  subject  to  someone  monitoring 
their  e-mail/*  said  Mr.  Schrader, 
whose  company  serves  about  100,000 
businesses  and  more  than  10  million 
users.  *1  believe  irstmconstrtutlonal 
and  HI  wait  for  the  Supreme  Court  to 
force  me  to  do  it/' 

Civil  liberties  groups,  meanwhile, 
said  that  today's  policy  announce- 


mem  was  an  inadequate  response  to 
the  growing  controversy  over  the 
deployment  of  Carnivore. 

“Today’s  speech  was  camouflage 
to  cover  the  mess  that  i$  Carnivore/' 
said  Barry  Steinhardi,  an  associate 
director  of  the  American  Civil  Liber- 
ties  Union.  “In  light  of  the  public  and 
Congressional  criticism  of  Carni¬ 
vore,  we  had  hoped  and  expected  far 
more  from  an  administration  that 
likes  to  tout  its  sensitivity  to  privacy 
rights.  Rather  than  glossing  over 
Carnivore,  Fodesta  should  have  an¬ 
nounced  that  the  administration  w  as 
suspending  its  use." 

Facing  growing  concerns  about 
Carnivore,  Attorney  General  Janet 
Reno  said  on  Thursday  that  she 
would  review'  whether  the  system 
was  being  used  in  a  manner  consis¬ 
tent  with  privacy  rights  in  the  Consti¬ 
tution  and  in  federal  law*,  a  subcom¬ 
mittee  of  the  House  is  set  to  hold  a 
hearing  next  week  on  the  system. 

While  the  civil  liberties  and  pri¬ 
vacy  groups  applauded  giving  judges 
greater  discretion  to  review'  certain 
kinds  of  requests  for  surveillance, 
they  were  critical  of  other  aspects  of 
the  proposal. 

Marc  Roienberg,  director  of  the 
Electronic  Privacy  Information  Cen¬ 
ter,  a  research  organization  that 
studies  privacy  issues  and  technol¬ 
ogy,  criticized  the  administration  for 
lowering  the  standards  for  surveil¬ 
lance  of  cable  modems  rather  than 
raising  the  standards  for  telephone 
surveillance. 

“The  Cable  Act  provides  for  one  of 
the  best  privacy  protections  in  the 
United  States/'  Mr,  Rotenberg  said, 
“The  question  is  whether  to  harmo¬ 
nize  up  or  harmonize  down.  Our  view 
is  this  harmonizes  down/' 

But  administration  officials  said 
the  Cable  Act  never  contemplated 
that  there  would  be  broad  use  of 
cable  modems  for  e-mail  traffic  and 
that  the  standards  used  for  obtaining 
warrants  for  telephone  surveillance 
should  also  apply  to  digital  commu¬ 
nications  through  cable  networks. 


1 
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'U.S.  Hopes 


£/  John  SofTxm 
e  hshupm  Pmt  Stag  ?  m*r 

The  Clinton  administration  yes-  * 
terday  called  for  updating  wiretap¬ 
ping  Jaws  to  extend  the  powers  of 
law  enforcement  to  the  online  world 
while  providing  new  legal  protec¬ 
tions  for  electronic  communication. 
Administration  officiate  also  an¬ 
nounced,  asexpecteiaplan  tolooS' 
en  con  trols  on  the  export  of  enejyp-  . 
tioit  software — the  programs  that 
help  Internet  users  scramble  mes¬ 
sages  and  data  to  protea  them  from 
PWjgeyes. 

On  the  wiretapping  issue.  White 
House  chief  of  stag  John  D.  Pode- 
sta,  in  3  speech  at  the  National  Press 
Club,  described  the  coming  legisla¬ 
tive  package  as  seeking  to  eliminate 
confusion  about  the  level  of  legal 
protection  for  various  forms  of  com¬ 
munication. 

Telephone  conversations  get  Cain 
ly  strong  protection  from  federal 
wireLap*  under  the  1966  Crime  Pa¬ 
trol  and  Safe  Streets  Act,  which  re¬ 
quired  s  court  order  and  high-level 
Justice  Department  approval  Wire- 
tape  rules  for  e'trtail  sent  by  dial-up 
modem  are  covered  by  the  Electron¬ 
ic  Communications  Privacy  Act  of 
I9S6,  That  law  might  not  cover  o- 
rmil  sent  by  high-speed  cable  mo¬ 
dem,  and  cable  companies  have  ar¬ 
gued  that  their  online  sendees 
should  bet  given  extremely  high  pro¬ 
tection  fro m  government  surveD- 
iance  under  the  Cable  Act. 

*1fs  time  to  update  and  harmo¬ 
nic  our  existing  laws  to  give  all 
forms  of  technology  the  same  legis¬ 
lative  protections  as  our  telephone 
conversations,"  Podesta  said. 

Lawmakers  said  they  welcome 
the  opport  unity  to  work  with  t  he  ad- 
ministration  on  these  issues.  Sen, 

Omit  G.  Hatch  (R-Utah),  who  has 
introduced  an  internet  pricey  bill, 
said:  ‘It  is  imperative  that  we  bal¬ 
ance  the  interests  of  law  enforce- 
ment  with  the  privacy  rights  of  the 


American  people,  We  must  ensure  that  appropriate 
checks  are  in  place  where  the  government  accesses  pri¬ 
vate  communications  of  Americans* 

Pod  esu  said  the  bate  making  up  the  package  wouldbe 
unveSed  within  10  days,  and  that  he  hopes  the  legisla¬ 
tion  can  be  passed  by  the  end  of  theyean 
Pbdesta  also  spoke  about  the  new-  surveillance  tech¬ 
nology  known  as  Carnivore,  which  gives  law  enforce¬ 
ment  authorities  the  ability  to  selectively  monitor  the 
'  Internet  traffic  of  mdteiduate.  mmhr  to  the  devices  that 
can  record  the  telephone  numbers  of  calls  made  and  re- 
cemd  by*  suspect  iMEke  full-fledged  wiretaps,  the  jth 
,  dirial  oversig ht  of  such  surveillance  1$  slight,  and  the 
protection  against  abuses  of  the  technology  by  tew  en¬ 
forcement  is  vreajc  Fodesta  called  for  greater  judicial 
oversight- 

The  Fodesta  speech  wus  not  web  received  by  rivS  Hh- 
erric^  advocates,  who  have  fought  Carnivore  and  other 
administration  at  tempts  to  expand  wir  etapping  capabO- 
tries  on  the  Internet  Barry  Steinhardt,  associate  dteec- 
tor  of  the  American  Civil  Liberties  Union,  called  the 
speech  ‘deeply  disappointing. , .  While  the  Oin  ton  ad- 


nMttsiratJon  s  proposals  have  some  heartening  qualit h 
to  them,  Lhe>f  are  too  little  and  too  late.1*  with  too  M 
tune  m  the  legislative  session  to  pass  new'  bills  The  Ca 
to  system,  Steinhank  said,  *r«pres«tts  a  m, 
threat  to  the  privacy  of  aH  Americans  by  giving  law  ei 
forcemeat  agendes  unsvo^mV-ri  „  ****  j.. 


wm  be  able  to  export  s 
pmsucaied  cry-ptopaphy  products  to  users  b.  any  n 

Vdon  md  to  Noma 

the  Caech  Republic,  Hungary,  Poland,  Japan,  New 
tod  and  *w*t«rknd.  The  government  wH  diminat 
the  statute^  3&day  waiting  period  before  such  export 
c m  e  hut  wtli  keep  m  place  a  requirement  tte 

I"?  technologies  be  submitted  to  the  government  for 
techmcd  reviews 

Encryption  hasbeen  a  high-tech  hatUefidd  tom  th 
early  daw  of  the  Ctoton  administration,  few  tedxaotc 
**?**. 35  m  the  fight  to  maintain  persona 

anti  DttSlfttCe  r 


Tt  ,  r  tr  ***  crourceroem  omoals  like  FBI  I 
redor  Louis  X  Freeh,  who  often  warns  that  crimina 
and  tmomts  can  use  ‘crypto"  to  cloak  thdr  plans  ar 
aOmbes,  High-tech  companies  successMy  argued  fh 
restrictions  harmed  only  American  comnanie 


encryption  products,  and  in  January  IheOmton  admin 
isti^ou  reduced  controls  on  encryption  exports. 

The  reducing:  of  these  reguiarions  wiS  cerulnlv  & 
pw  u,S.  sote  makers  to  compete  m  the  global  mar* 
ketpbce."s aid  Robert HoGeyman, th.chielTiUi^of 
Ue  Business  Software  Alliance, 


From  Associated  Press 


r*  ^nmuroN~7bt  White  Heus< 
proposed  leglsiatson  Monday  to  update 
wiretapping  rules  so  that  kmi  matter 
isom  currently  applied  to  telephone  calls 
are  extended  to  electronic  communica¬ 
tion,  such  as  e-mail 

,J^e  $*“  wouk1'  iwj^re  law  enforce- 
“  o..iaafs  to  obtain  high-level  ap¬ 
proval  before  applying  for  a  court  order 
to  intercept  the  content  of  e-tnail-in  vm» 

ropLTcansWteth3\fiOVeroi,Sts^ 
B&sicsily,  the  same  communicate  if 
difkrent  w3,y  ^through  a  phone 
call  or  a  dial-up  modem— is  subject  to  dif¬ 
ferent  and  inconsistent  privacy  stand' 

ftte  "  ^  iXhiis  House  Chief  of  Staff 
John  Fofeu,  in  announcing  the  propos¬ 
als.  "IV*  time  to  update  and  harmonize 
our  existing  tews  to  give  all  forms  of  tech- 
noiory  the  same  legislative  protections  a* 
our  telephone  conversations,” 

The  wiretap  proposal  also  addresses  so- 
caded  "trap  and  trace"'  orders,  which  aj. 
Isw  te  enforcement  officials  to  identify 
the  source  of  a  phone  call  or  an  e-mail 
but  not  Its  content.  Under  the  proposal 
kw  enforcement  officials  would  onlv 
need  one  order-even  to  trace  an  e-mail 
or  a  phone  call  that  may  travel  through 
multiple  phone  carriers  or  Internet  pro¬ 
viders-  ' 


Officials  also  could  trace  such  com  mu- 
mentions  without  prior  approval  in  an 


emergency  situation,  such  as  when  a 
computer  is  under  attack. 

But  for  the  first  time,  the  administra¬ 
tion  *s  proposing  that  a  federal  or  state 
judge  independently  determine  whether 
the  facts  support  such  a  trace  order.  ' 

Officials  were  asked  how  those  changes 
woiild  impact  the  new  "Carnivore"  sys¬ 
tem,  which  the  FBI  is  using  to  obtain V 
mails  of  investigative  subjects  with  a 
search  warrant  When  Carnivore  is 
pieced  at  an  Internet  service  provider,  it 
scans  all  incoming  and  outgoing  e-mails 
for  messages  associated  with  the  target  of 
a  criminal  probe. 

If  the  Carnivore  system  is  being  used 
to  intercept  the  content  of  electronic 
communications,  then  law*  enforcement 

officials  would  need  high-level  Justice 
Department  approval  before  obtaining  a 
court  order  and  stricter  standards  limit' 
mg  Us  use  would  apply,  Podesta  said. 

The  FBI  says  the  tool  already  is  $uh~ 

t0  intense  oversight  from  its  own  in- 
te-mal  controls,  the  Justice  Department 
and  the  eourts-wiih  signification  penal- 
tie*  for  misuse  of  the  system. 

The  proposed  measures  also  would  ad¬ 
dress  inconsistencies  in^how  current  law' 
applies  to  different  networks  carrying  In¬ 
ternet  traffic.  For  example,  now  that  ca¬ 
ble  systems  are  being  upgraded  to  offer 
two-way  services,  laws  that  apply  to  dial¬ 
up  modems  over  phone  lines  should  be 
extended  to  cable  connections.  Bodes u 
said. 
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L  By  Tm  Bmms 

»  Ssa//  <>/  The  Wall  JovRJtfAt. 

I  -  WASHING  X  ON  “  The  White  House  is 
;  purging  changes  in  IIS.  law  to  make  ii  eas- 

*  ter  for  authorities  to  eavesdrop  on  Internet 

*  communications  such  as  electronic  mail, 

\  updating  what  the  government  described 

*  as  wiretap  laws  written  for  an  earlier  era. 
j  The  administration  said  that  the 
r  changes  would  enhance  legal  privacy  pro- 
;  tections  because  they  would  require,  for 
>  example,  approval  by  senior  Justice  De- 
;  parimern  officials  before  the  Federal  Bo 

!  of  investigation  could  use  software 
«  surveillance,  such  as  its  "Carnivore*  $y$- 

*  teiHv  That  approval  already  Is  required  in 
;  cases  where  law  enforcement  wants*  to 
f  monitor  telephone  conversations, 

;  /The changes  require  U.S.  judges  to  sup- 
Tffoss  electronic  evidence  obtained  by  jiie* 
^.wiretap;  current  Jaw  mandates  sop-  ; 
jpressjon  in  such  circumstances  of  only  * 
oral  or  written  communications,  not 
e-mail.  The  proposals  were  all  made  by 
the  Justice  Department  in  a  March  study 
that  identified  what  the  government  said 
were  deficiencies  m  enforcing  laws 
against  crimes  on  the  Internet, 

The  American  Cm!  Liberties  Union 
said  the  Whitt  House  announcement  was 
'  "deeply  disappointing,”  because  it  did  not 
Include  any  promise  to  suspend  use  of  Gar¬ 
ni  v0  re  >  which  the  group  charged  gives  the 
government  “unsuperrised  access  to  a 
nearly  unlimited  amount  of  communica¬ 
tions  traffic.” 

The  Internet  Alliance,  a  Washington 
trade  group  for  Internet  proriders,  said 

.Tapping  Into  Privacy 


the  White  House  proposals  ”nm kt  sense/ 
but  also  warned  that  its  member  compa¬ 
nies  “should  not  be  deputised/  a  spokes* 
man  said. 

The  proposals  were  announced  at  the 
same  time  that  the  administration  relaxed 
restrictions  on  the  export  of  powerful  en¬ 
cryption  technology  to  the  European 
Union  and  to  Australia,  Norway;  the  Czech 
Republic*  Hungary;  Poland,  Japan,  New 
Zealand  and  Swdtierland,  White  House 
Chief  of  Staff  John  Podesta  said  the 
change,  which  will  benefit  some  US.  hard¬ 
ware  and  software  firms,  was  not  offered 
in  exchange  for  the  Mgh-fedmologv  indus¬ 
try^  support  of  the  White  House  wiretap 
proposals,  “We've  never  tried  to  link  those 
two/  he  said. 

The  White  House  also  sought  to  give 
authorities  undisputed  access  to  the  Inter¬ 
net  traffic  of  roughly  2,2  million  consum¬ 
ers  using  cable  modems.  And  St  proposed 
making  it  easier  for  police  to  obtain  court 
orders  to  trace  the  transmission  and  re- 
ceipt  of  Internet  data  nationwide  without 
asking  permission  from  s  judge  in  every 
jurisdiction  the  data  passes  through.  An¬ 
other  change  would  give  judges  greater 
latitude  in  denying  those  requests.  But  in 
extraordinary  cases,  such  as  a  hacker  at¬ 
tack,  the  FBI  could  perform  tracing;  then 
obtain  court  approval  as  much  as  4S  hours 
later 

A  legal  dispute  continues  between  Inter¬ 
net  providers  and  law  enforcement.  The 
nation's  cable  internet  providers  have  ar¬ 
gued  that  they  are  not  required  under  the  * 

Pkm  Turn  to  Pw>?  A$t  Column  S  \ 


'Some  key  changes  the  White  House  is  seeking  m  internet  privacy: 

•  Requiring  higher  level  approval  by  senior  justice  officials  to  perform  Internet 
?  wiretaps  to  read  e-mail 

•  Requiring  judges  te  discard  electronic  evidence  obtained  in  an  illegal  wiretap, 

•  Mandating  that  Internet  wiretaps  to  read  e-mail  be  used  only  when 
Investigating  the  most  sefious>chmes, 

•  Requiring  cable-internet  companies  to  turn  over  customer  information  when 
^  presented  with  a  judge's  order. 

£  Aifowtng  authorities  to  seek  a  single  Judge's  order  to  truce  Internet 
v communications  nationwide  across  different  jurisdictions . 
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Updating  of  Wiretap  Law  for  E-Mail  Age 
M  Lrged  by  the  Clinton  Administration 


O.S,  Cable  Act  m  turn  over  subscrii 
formation  without  firing  customers 
fxirt  unity  to  fight  the  disclosure  m 
However,  the  Justice  Department ; 
it  is  entitled  to  cable  Internet  data 
Hie  Electronic  Communications  f 
Act  mtMut  warning  the  customer  r 
vance  about  its  proposed  saneihanfc 

District  Judge  XVoung  of 

called  the  dispute  “a  thorny  and  mu 
mm  m  a  ease  last  year,  in  whii 
ordered  an  unidentified  cable  interne* 
vider  to  turn  over  the  customer's  re"1 
Judge  Voung  acknowledged  that  hi 
mn  should  not  be  read  too  broadly  s 

”nc?  m*  dBy  i0 
ephemeral  puzries.” 
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on  Encryption 
Software  Exports 

ASHLEY  DUNN 

and  CHARLES  WU» 

Tints  st*H  wKims 

The  Clinton  administration  on  Mon¬ 
day  further  eased  the  remaining  re¬ 
strictions  on  selling  high-powered  en¬ 
cryption  products  overseas,  clearing 
the  way  for  American  firms  to  export 
to  the  European  Union  and  several 
other  key  trading  partners. 

The  new  policy  drops  a  requirement 
that  U.S,  companies  get  a  special  It- 
*  cense  to  sell  encryption  products— a 
process  that  previously  Involved  o 
technical  review  or  a  30-day  delay  . 

In  addition,  the  rules  allow  compa¬ 
nies  to  sell  their  products  to  not  only 
businesses  and  consumers,  but  also 
government  agencies,  which  used  to 
require  a  special  license. 

The  rules  apply  to  encryption  ex¬ 
ports  to  the  15  nations  of  the  European 
Union,  as  web  as  Australia,  Norway. 
Czech  Republic,  Hungary,  Poland,  Ja¬ 
pan.  New  Zealand  and  Switzerland, 
The  new  rules  follow  the  adminis¬ 
tration's  major  turnaround  in  terns* 
*0'-  when  it  finally  opened  the  w  ay 
for  companies  to  export  the  hardest* 
to-aack  scrambling  technology'. 

American  technology  companies 
and  privacy  advocates  had  fought  for 
years  for  permission  to  export  its  cm 
ciyption  technology  abroad 
The  industry  argued  that  the 
spread  of  strong  encryption  would 
fuel  electronic  commerce  and  reas- 
^ire  consumers  that  their  credit  card 
numbers  and  other  private  communi¬ 
cations  would  not  be  compromised. 

White  House  Chief  of  Staff  John 
Podesu,  speaking  at  the  National 
Press  Club,  described  the  changes 
announced  on'  Monday  as  pan  of  an 
ongoing  effort  to  update  VS.  policy. 

"The  Internet,  like  Morse's  tele¬ 
graph,  brings  with  it  new  possihih 
itiesl,>  he  said.  "It  also  brings  new 
challenges  to  our  most  fundamental 
values  and  the  need  for  new  laws  and 
new  protections  to  maintain  them." 
Industry  and  security  experts  wel¬ 


comed  the  latest  announcement  as 
another  sign  of  the  federal  govern¬ 
ment’s  new-found  support  of  liberal¬ 
izing  encryption  exports. 

1  "It  s  obviously  very  important  if 
ILS.  software  companies  are  going  to 
compete  in  the  global  market/  said 
Ami?  Ycitm  a  former  department  of 
Defense  security  official  and  presi¬ 
dent  of  RipTeeb,  a  security  company 
m  Alexandria,  Va. 

According  to  Scott  Schnelf,  senior 
vice  president  of  RSA  Data  Security, 
a  top  encryption  software  producer, 
the  new  rules  are  important  because 
they  remove  rertrictiom  to  selling  to 
national  governments. 

Governments  are  often  the  biggest 
buyers  of  security  software,  particu¬ 
larly  in  the  recently  democratized  na- 
bans  of  Eastern  Europe. 

"Both  the  relaxation  and  mmalk 
nation  around  government  use  of  the 
technology  is  a  realisation  of  the  core  - 
importance  of  the  security  over  the 
Internet/  Schnell  said,  'This  is  a  tre¬ 
mendous  boost  for  the  US.  software 
industry'/ 

But  others  said  that  until  the  regu¬ 
lations  can  be  thoroughly  reviewed 
by  legal  experts,  their  impact  would 
be  uncertain. 

The  devil  in  this  case  is  in  the  de- 

taua.  said  Jeff  Schiller,  a  ii-ading  se- 
curiiy  expert  and  network  manager 
for  Massachusetts  Institute  of  Tech¬ 
nology.  Law  erioreemem  and  safety 
concerns  remain,  be  said.  "Haw  are 
those  addressed?  I'd  be  very  sur¬ 
prised  if  they  were  just  lifting  the 
controls/' 

He  said  that  he  suspects  hidden  re- 
frictions  could  .stiff  bar  the  export  of 
snen  products  to  the  wrong  coun¬ 
tries. 

Let's  say  someone  in  one  of  the 
forbidden  countries  gets  an  ac- 
comi  m  America  Online/*  Schiller 
said.  "When  they  use  their  Web 
browser  to  get  m  the  Net,  it's  go¬ 
ing  to  say  Virginia  [where  many 
AOL  server  computers  that  route 
Internet  traffic  are  located].  I  don't 
know  they  are  from  Libya,  Under 
those  circumstances  who  is  respon¬ 
sible?  Am  I  responsible?  k  AOL  re¬ 
sponsible?" 

But  Schiller  said  that  any  relaxa¬ 
tion  of  export  controls  is  an  ac¬ 
knowledgment  of  reality, 

“You  cannot  turn  the  tide  of 
technology  back,"  he  said.  "The 
bad  guys  are  going  t  o  do  what  they 
will  do/’  while  legitimate  users  of 
encryption  products  are  harmed  by 
export  controls. 
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Rules  on  encryption 
exports  are  relaxed 

The  United  States  has  eased  its  ndes  on  exporting 
encryption  products  to  the  European  Union  and  other 
key  trading  partners 
m  an  eflbrt  to  improve 
security  in  cyberspace 
and  promote  electron¬ 
ic  commerce,  the 
White  House  said 
Monday  j 

US,  companies  no 
longer  need  an  export 
license  to  sell  encryp- 
tion  products  to  users 
in  the  key  trading 
countries,  the  White 
House  said,  i 

The  policy  allows 
US.  exporters  to  ship  : 
their  products  without 
waiting  for  a  technical 
*  a*™  <*»*.**>  re^ew  or  3  30  -  day 
Pode$tar  Change  should  not  delay  as  they  have  In  j: 
threaten  US,  security  the  past.  Businesses 
<  ,  ..  .  ,  and  privacy  advocates 

had  said  that  US.  export  rules  were  too  restrictive,  but 
law  enforcement  c&iate  said  sophisticated  encryp¬ 
tion  aids  international  criminal  enterprises  and  terro¬ 
rists,  White  House  Chief  of  Staf  John  Podesta  said  the 
changes  should  provide  adequate  security  : 

The  White  House  also  proposed  legislation  to  up¬ 
date  wiretapping  rules  so  that  protections  currently 
applied  to  telephone  calls  are  extended  to  electronic 
communications  such  as  e-mail.  The  changes  could  af¬ 
fect  the  system  the  FBI  uses  to  access  the  e-mails  of 
cnminaJ  suspects,  investigator  would  have  to  obtain 
high-level  approval  before  seeking  a  court  order. 
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House  Rejects 
Bill  Limiting 
Web  Gambling 

Parties  Sharply  Divided; 
White  House  Opposed 


By  Dam  Mmotei 
and  John  $CHvx*n 
VT&shvigim  B ass  Staff  S  teers 

The  House  last  night  defeated  a  hill  that 
would  have  barbed  most  forms  d  online  gam- 
bldg,  legislation  intended  to  curb  the  explo¬ 
sive  growth  of  casino-style  wagering  on  the 
World  Wide  Web. 

In  a  vote  that  reflected  sharp  divisions 
within  both  major  parties  over  the  issue,  44 
Republicans  joined  114  Demccrats  and  one 
independent  to  defeat  the  measure.  Under  a 
procedure  to  bring  the  bill  to  the  floor  with' 
mi  amendments,  a  two-thirds  vote  of  those 
present  w^as  required  to  pass  the  legislation. 
The  final  Laily  of  245  to  159  fell  25  votes  short 
of  the  270  needed. 

The  bOI  drew  opposition  from  lawmakers 
and  advocates  concerned  shout  federal  reg¬ 
ulation  of  Internet  contend  as  welt  as  the  po¬ 
tential  for  invasion  of  privacy.  Critics  also 
raised  concerns  that  to  make  the  legislation 
palatable  to  the  politically  mfkentk]  pari¬ 
mutuel  horse  racing  and  dog  racing  In¬ 
dustries.  GOP  leaders  had  agreed  In  exempt 
lions  that  would  actually  legalise  an 
expansion  of  opportunities  lor  online  gam¬ 
bling; 

The  bill  was  intended  to  address  growing 
fears  among  bwmakers  afruyf  the  explosive 
growth  of  unregulated  online  rites  where  in- 

dividuals  can  engage  in  card  games 
and  other  easinostyk  gambling  on 
their  computers.  More  than  700  such 
sites,  many  of  them  run  out  of  foreign 
countries  or  offshore  havens,  are  m w 
operating  without  regulation,  with 
roughly  $12  billion  wagered  annu¬ 
ally. 

Under  ih$  bill  defeated  yesterday, 
stale  law  enforcement  agenda 
would  have  been  able  to  go  to  court 
to  obtain  orders  requiring  Internet 
service  providers  to  block  access  to 
Web  sites  that  engaged  m  Illegal  gam¬ 
bling 

Bef  ore  last  night's  vote  ( Rep.  Rob¬ 
ert  W.  GoodJsite  (R-Va,}<  chief  Spon¬ 
sor  of  the  bill,  cited  a  bun}1  of  serial 
ilis  linked  to  gambling--mme,  bank¬ 
ruptcy.  addiction  and  more— and 
said  that  Internet  gambling  will  bring 
citizens  the  same  problems  *as  you 
would  have  if  you  had  a  casino  in  yw 
home  town.4* 


But  the  White  House  it 
*mm$f  opposed  the  bill  and 
stressed  in  particular  its  objections  to 
the  exemptions  that  would  aBmv  the 
parimumd  industry  to  conduct  on- 
Hne  betting  under  cootroSed  condi¬ 
tions. 

Although  the  Senate  has  passed  a 
similar  hi,  it  appeared  unlikely  kst 
night  that  the  GOP  kadership  m  the 

House  will  attempt  to  Img  the  meas¬ 
ure  back  to  the  House  again  tMs  year 
gwea  the  Med  time  and  the  diSS- 
culty  of  craftmg  a  exnprombe  on 
snch  a  esmplisK  issue. 

Yesterday's  vote  was  the  cukdna- 
tbn  of  one  of  flic  year's  most  hotly 
,  contested  lobbying  battles  on  Capitol 
Hdl  generating  a  variety'  of  strange 
alliances  on  both  sides.  Allied  with 
the  Las  Vegas  casino  industry' m  sup¬ 
port  of  the  MS  have  been  religious 
group*  that  are  among  the  GOFs 
core  group  of  supporters,  including 
the  Christian  Coalition,  the  Southern 
Baptist  Convention,  the  Fan%  Re¬ 
search  Coundl  and  Focus  on  the 
Family. 

♦  But  the  booming  high-tech  bdus- 
try;  which  the  GOP  is  als-o  courting, 
had  serious  concerns,  and  a  number 
of  governors  objected  that  the  legisla¬ 
tion  would  not  provide  an  exemption 
for  stale  lotteries  to  sell  rickets  onli  ne 
within  their  own  states. 

MeanwhOe,  horse  and  dog  raring 
venues  have  been  fighting  dedhung 
attendance,  and  stiffer  comperirion 
from  other  forms  cf  betting.  They 
saw  the  felS  as  a  w*ay  to  ensure  their 
long-term  survival  by  allowing  them 
to  marKCv  their  events  over  the  Inter¬ 
net 

Goodin  tie  assured  House  mem¬ 
bra  yesterday  that  the  parimutuel 

provisions  only  authorised  what  is al¬ 
ready  kgal  under  riedemJ  gambling 
law,  and  did  not  constitute  an  expan¬ 
sion.  Action,  he  said,  was  essential  on 
the  larger  issue  of  earincKype  gam¬ 
bling. 

But  the  White  House  charged  that 
bill  would  have  brightened  the  likeli¬ 
hood  that  duldren  and  other  vul¬ 
nerable  groups  would  fee  able  to  get 
unsupervised,  unlimited  access  to 
ambling  act!  vines  on  home  comput¬ 
ers. 

This  MB  appears  to  be  designed 
to  protect  certain  forms  of  Internet 
gambling  that  currently  are  tBegafe 
whik  potentially  opening  the  flood¬ 
gate  for  other  forms  of  illegal  gam¬ 
bling/  the  White  House  S3id  in  a 
statement 


Along  with  concerns  about  the 
parimutud  betting  provisions,  some 
lawmakers  m  both  parries  expressed 
reservations  about  the  extent  of  fed¬ 
eral  incursion  into  the  prerogatives 
of  the  states, 

*You  would  have  the  federal  gov¬ 
ernment  dictate  to  Internet  service 
providers  what  services  they  can  of¬ 
fer/  said  Rep.  Christopher  Cox  (R- 
C&lif.)  in  opposing  the  lepslatiom  He 
said  it  was  ^w'didmeotiooed/  but 
wmdd  ^create  enormous  regulatory' 
probkuk/ 

Goodklie  and  the  House  GOP 
leadership  sought  to  win  more  sup¬ 
port  for  the  W  with  kst-mmute 
changes  aimed  at  relieving  some  of 
the  concerns  cf  dv3  liberties  groups. 
Rep.  Jerrold  Nadler  (D»N,Y.)  agreed 

to  support  the  legislation  onlv  after 
lanroage  wasadded  gmngthel opera' 
tors  of  Web  rites  that  have  been  shut 
down  fey  court  order  up  to  60  days  to 
appeal  ■ 

Yesterday's  outcome  represented 
another  tna  serfesof  sometimes  awk- 
wiird  attempts  by  Congress  to  ad¬ 
dress  the  controversial  Issue  of  reg- 
riaring  Internet  content  The 
Supreme  Court  struck  down  as  un- 
consrituri ormfly  broad  the  1996  Corn- 
roumcatioos  Decency'  Act  which 
made  it « federal  crime  to  make  adult 
materials  available  to  minors  via 
computer. 

Congress  came  back  with  the 
Chdd  Online  Protection  Act  a  nar¬ 
rower  attempt  to  regulate  commer- 
rial  sites'  showing  pornography  on 
the  World  Wide  Web.  That  law  fas 
been  challenged  by  dvfl  liberties 
^oups  and  publishers,  and  is  cur- 

before  federal  appellate  courts. 
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‘Carnivore’  Won’t  Devour  Cyber-Privacy 


By  Bwcz  BmKomrz 
On  Monday  the  White  Hawse  propose 
nm  legislation  regulating  surveillance  by 
law  enforcement  agendas  on  the  Internet, 
But  cm!  libertarians  are  already  complain- 
m  &&  toi$  plan  does  little  to  address  the 
problems  ostensibly  raised  by  Carnivore, 
the  FBI's  new  software  system  tor  perform¬ 
ing  court-ordered  wiretaps  at  Internet  ser¬ 
vice  providers  USPs). 

Using  a  laptop  computer,  law  enforce¬ 
ment  officials  can  book  Carnivore  into  an 
ISP's  network.  Once  installed,  it  reads  the 
headers  of  each  e-mail  message -listing 
the  sender,  recipient  and  subject  of  the 
message- as  it  passes  through.  If  the 
sender  or  recipient  is  the  target  of  a  taps 
Carnivore  records  the  message, 

Rights  at  Risk? 

Here's  the  rub:  Before  Carnivore  can 
know  whether  a  message  belongs  to  a  tar¬ 
geted  party,  it  must  browse  the  headers  of 
all  the  messages  passing  through  the  ISP. 
With  a  traditional  phone  tap,  law  enforce¬ 
ment  officers  only  listened  to  the  tele¬ 
phone  line  that  the  subject  of  the  tap  was 
using.  The  ACLU  and  other  critics  com¬ 
plain  that  when  Carnivore  reads  the  head¬ 
ers  of  anyone  who. is  not  a  target  it  vio¬ 
lates  their  rights. 

The  ACLU  and  other  Carnivore  critics 
need  to  get  a  grip-and  a  better  under¬ 
standing  of  the  new  technology. 

Unlike  old-fashioned  analog  telephone 
calls,  e-mail  messages  are  transmitted  dig¬ 
itally.  A  computer  slices  and  dices  the  mes¬ 
sage  into  packets,  each  with  an  identify¬ 
ing  tag.  The  packets  then  spread  out 
throughout  the  internet,  finding  the  most 
efficient  path  to  the  destination.  When 
they  arrive,  they  are  reassembled,  and  the 
recipient  gets  the  message.  As  a  result, 
with  e-mail  you  cannot  “tap  a  line"  be¬ 
cause  often  there  is*  literally,  no  particu¬ 
lar  line  to  tap.  All  you  can  do  is  scan  the 
messages  that  pass  through  a  link  a  sus- 
peef  is  known  to  use -like  his  ISF-and 
pick  out  the  ones  that  belong  to  him 
Thafs  what  Carnivore  does. 

The  ACLU  complains  that  using  a  com¬ 
puter  to  monitor  an  ISP  system  would  col¬ 
lect  vast  amounts  of  innocent  data.  But 
what  do  they  expect  toe  feds  to  use~a 
writer  ^  an  abacus?  Note  to  FBI: 
Hire  a  better  public  relations  firm,  and 
name  your  next  project  "Vegetarian.” 


These  kinds  of  flaps  are  happening 
more  and  more  often.  Last  April  some  pri¬ 
vacy  advocates  complained  when  the  FBI 
requested  $15  million  tor  “Digital  Storm/ 
a  program  for  monitoring  telephone  calls 
and  analyzing  recordings*  fit  September,  a 
programmer  to  North  Carolina  found  the 
notation  “NSA  Key*'  in  a  Microsoft  soft¬ 
ware  patch.  Soon  rumors  bounced  through 
the  Internet  claiming  Windows  had  a  back 
door  that  allows  the  National  Security 
Agency  to  monitor  your  computer,  {ML 


There's  a  lot  of  concern  about  the  ability 
of  governments  to  monitor  communications 
in  tiie  digital  age ,  In  fact,  it's  getting  harder, 
not  easier,  for  them  to  listen  in. 


fttmot 
;  tottou 

(vM 


emsoft  explained  that  toe  tag  merely  signi¬ 
fied  that  the  software  complied  with  the 
agency’s  security  standards.) 

The  granddaddy  of  all  bogus  fears, 
though,  is  Echelon*  If  you  believe  some 
European  Union  parliamentarians,  the 
United  States  and  Britain  operate  an  inter¬ 
national  network  that  monitors  virtually 
all  communications*  and  extracts  choice 
nuggets  with  powerful  computers  that  ret> 
ogaiae  key  phrases  in  messages  like  “as¬ 
sassination/  terrorist  attack"  or  “indus¬ 
trial  secret  / 

in  reality*,  it’s  not  easy  to  find  a  specific 
message  to  a  hood  of  free-flowing  digital 
data*  That’s  the  whole  reason  tor  getting  a 
court  order  for  a  wire  tap.  If  you  cannot 
hook  into  an  ISP,  you  have  to  do  a  lot  of 


searching  to  fmd  the  message  you  war*,  tc 
intercept.  j 

Thai  is  also  why  the  European  elm- 
paign  against  Echelon  is  so  quixotic.  Tr 
the  folks  at  N5A  intercept  communicati 
and  they  have  powerful  computers  and 
genious  software  that  helps  with  toe  j 
cesstog*  But  ft  is  impossible  for  even 
best  computer  system  to  routinely  i 
through  all  of  toe  world’s  tetammun 
tions  and  pull  out  telltale  messages,  as  the 
Echeton  paranoids  would  have  you  1 
iieve. 

" .  . . " — ■  Usually  you  n 

bout  the  ability  *o  know  what  you 
„  -  ,  v  looking  for  i 

ytntttUfiUfM tiOHS  Where  the  mess: 

getting  harder.  m&}  *^€Sr  bef 

f  *  *  you  have  much  o 

m,  chance  of  fmdingjft. 

Also,  the  cases  r' 
which  one  messi 
tells  a  whole  st< 

OWiv  sre  rsriL  000(5 1 

JJJ&jkA  enforcement  and 

telllgence  usual  iy 
B  quires  mufti] 

Y\  S0Urce5  aM  coll 
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cates  have  the  sfojy 
reverse^  W*  gettii 
EfcrsgjS Sfe|3>j  harder,  not  cash 

SWjtof  for  our  law  enforc 

0{W I  mem  and  total 

pnee  organ iLat jo] 
to  listen  in  on  cor 
mtmications.  In  li 
old  days  you  could  tap  a  line  or  intercept 
microwave  link.  It  s  much  more  difficult  s 
capture  digital  messages  that  pass  ov< 
fiber  optics  or  bounce  through  cellular  m 
works.  And,  with  strong  encryption  sol 
ware  freely  available  world-wide,  anyor 
really  determined  to  keep  a  message  $< 
tret  can  usually  do  so. 

If  you  have  any  doubts,  just  recall  hoi 
many  intelligence  surprises  we  have  ha 
lafefy-toe  Indian  nuclear  test*  toe  Non 
Korean  missile  test,  the  terrorist  bomt 
mgs  of  American  targets  in  the  Mideas 
and  Africa,  Part  of  the  problem  is  that  w 
cannot  get  to  many  of  toe  sources  that  w 
used  to,  and  everyone  is  getting  better  a 
concealing  their  commutations. 


C 
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So  why  is  K  so  easy  to  stir  up  these 
wmttwwstes  about  privacy?  The  simple 
met  is  tnat  relations  between  the  govern* 
ment  and  JAe  mw  information  industries 
are  fousy  There  is  too  much  suspicion  and 
too  little  communication. 

The  administration  gets  part  of  the 
mm$  for  Us  ham  handed  policies.  Carm* 
21*  Mf*  **m&.  A  lot  of  contro- 
w  ^ave  ^C€ft  defused  if  the  FBI 
nad  offered  more  insight  info  how  the  sys* 
to  worked  and  how  the  rights  of  nonius- 
peets  would  be  protected 

But  the  recart  of  the  technogeeks  has 
not  been  much  better.  Thev  often  act  as 
though  Jaw  enforcement  officials  have  no 
husasess  poking  into  their  activities  at 
au~&$  though  one  could  stop  international 
compoter  criminals  with  g  good  neighbor¬ 
hood  watch  program. 

)■  ?  ~  811 103  eaS}!  10  l9SB  of  the  fact 
tnat  Canuvore’s  main  targets  are  cvber- 
crtoinaJs-in  other  words,  the  kinds  of 
crocks  who  are  a  plague  on  the  Internet 
and  target  dot-com  companies.  Growth 
rates  for  internet  shopping  have  been  siip- 
ptng  lately.  According  to  some  excerts 
wwry  about  whether  their  credit 
cart  numbers  and  health  records  are  safe. 
»ou  would  think  that  e-business  would  be 
hie  first  to  support  better  Saw  enforcement 
on  the  net 

Commas  Goals,,  ,  ' , 

Ail  fhe  good  guys  in  this  dispute  nave 
twnmon  goals.  Defense  and  imeUirehce 
omeiafs  warn  to  protect  the  nation’s  cam 
mmmmns  infrastructure.  Law  enforce* 
ment  officials  want  to  chase  croote>  and 
companies  want  the  cops  to  catch  them 
Consumers  warn  privacy  The  path  to  m  i s 
me  same:  secure  information  systems 
reasonable  cooperation  from  the  private 

***"*  ^Fess'ive  law  enforcement 
and  effective  intelligence  closely  moni¬ 
tored  by  responsible  public  officials.  ' ; 

Fixing  the  relationship  between  Wash¬ 
ington  and  Silicon  Valley  needs  to  be  a  Iod 
TOy  for  the  next  administration I  rS 
wb  people  henefitung  from  controversies 
«  «»  wr  Carnivore  are  terrorists 

cnmirtals:  und  rogue  states. 

Mr- Xftemt*  is  cm&rck  fellow  oi'iiie 
“Ri*  ^"fhor  o/  * Best 
Thiih:  Intelligence  in  the  infomatkm  Age” 
frofo  umwrstfy  Press,  fflOdh 
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Questions  for  the  Record 
June  20, 2000 


Senator  Kvt: 

Q;  Is  the  NIPC  able  to  proside  indications  and  warnings  of  an  attack?  For  example,  does 
the  Center  have  the  ability  to  detect  anomalous  activity  or  patterns  In  key  communications 
nodes  that  might  indicate  something  is  about  to  happen? 

The  NIPC’s  ability  to  perform  “indications  and  warning”  is  dependent  first  and  foremost 
on  its  ability  to  quickly  gather  information  from  multiple  sources  about  an  ongoing  or  imminent 
attack  (whether  an  intrusion,  a  virus,  a  denial  of  service,  or  other  form  of  attack).  The  NIPC 
does  not  operate  any  detection  mechanisms  on  any  government  or  civilian  systems.  Thus,  we  do 
not  get  “indications”  in  an  automated  sense  from  any  detection  devices.  In  tins  sense,  I&W  in 
the  cyber  world  is  very  different  from  I&W  in  tire  nuclear  missile  or  conventional  weapons 
world,  where  radars  and  other  devi  ces  can  provide  advanced  warning  of  an  attack.  Rather,  we 
get  relevant  information  from  intelligence  sources,  criminal  investigations,  “open  sources”  (such 
as  media  and  the  Internet),  and  from  industry  and  government  contacts.  We  “detect”  anomalous 
activity  in  key  communications  nodes  only  if  the  owner/operator  of  that  node  detects  it  and 
informs  the  NIPC,  an  FBI  Field  Office,  or  another  agency,  or  if  we  learn  through  criminal 
investigation  or  intelligence  sources  that  the  node  is  being  attacked.  Tire  key  to  the  NTPC’s 
ability  to  do  this  is  the  development  of  connectivity  and  close  interaction  with  numerous  Defense 
and  Intelligence  Watch  centers,  FBI  Field  Offices,  other  Law  Enforcement  organizations, 
computer  anti-virus  association  groups,  private  and  public  Computer  Incident  Response  Teams 
(CIETs)  and  Computer  Emergency  Response  Teams  (CERTs),  foreign  law  enforcement 
agencies,  and  private  industry  (both  individual  companies  and  information  sharing 
organizations).  Over  the  past  two  years,  the  NIPC  has  made  substantial  progress  in  developing 
these  relationships,  but  this  is  a  continuing  task  and  more  work  remains  to  be  done.  One  of  the 
main  reasons  for  our  extensive  outreach  programs  is  to  build  trust  and  willingness  on  the  part  of 
private  companies  to  report  cyber  incidents  to  us,  and  these  efforts  am  bearing  fruit.  In  addition, 
PDD-63  directs  other  federal  agencies  to  report  incidents  to  the  NIPC  directly.  Many  agencies 
are  doing  this,  but  there  is  room  for  improvement  with  others.  In  addition  to  reports  from 
companies  and  agencies,  the  NIPC  Watch  actively  scans  all  available  governmental  and  private 
sector  sources  for  reports  or  information  regarding  cyber  activity1,  and  interacts  throughout  each 
day  with. other  watch  centers  to  share  information. 

♦  ‘ 

Once  information  (or  “indications”)  of  an  attack  is  received  and  analyzed,  the  NIPC  can 
issue  a  warning,  alert,  or  advisory  through  numerous  means,  depending  on  the  appropriate 
audience.  Warnings  can  be  issued  to  specific  targeted  companies  through  FBI  Field  Offices  or 
by  the  watch  directly;  other  federal  agencies  can  be  notified  by  e-mail,  secure  facsimile,  and 
telex;  state  and  local  law  enforcement  can  be  warned  by  NLETS;  industry  can  be  warned  through 
InfiaGard  secure  email  and  website  and  through  ANSIR  (an  e-mail  system  that  reaches  tens  of 
thousands  of  companies);  and  fee  general  pubic  can  be  warned  via  fee  NIPC  webpage  and  the 
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news  media.  All  of  these  mechanisms  have  been  used  numerous  times  (as  discussed  in  the 
answer  to  the  next  question). 

Senator  Kyi’s  question  goes  to  the  heart  ofl&W  in  the  cyber  world:  should  the  Nation 
have  the  capability  to  detect  intrusions  into  government  or  private  sector  systems  in  an 
automated  fashion,  without  having  to  rely  on  human  detection  and  reporting?  The  controversy 
attending  the  Administration's  recent  “FHMET”  initiative,  which  is  a  limited  proposal  to  place 
automated  intrusion  detection  devices  on  federal  agency  networks,  identified  many  of  the  privacy 
and  other  issues  such  a  system  would  raise,  particularly  if  it  were  extended  to  privately  owned 
networks.  The  government’s  approach  at  the  present  time  is  to  encourage  industry  to  protect  and 
monitor  its  own  systems,  and  to  report  anomalous  activity  voluntarily.  The  NIPC  works  within 
that  overall  policy  to  encourage  private  sector  reporting  as  a  critical  part  of  its  I&W.  Examples 
of  this  include  InfraGard  and  the  incident  reporting  pilot  program  we  have  developed  with  the 
energy'  sector  through  the  North  American  Electrical  Reliability  Council  (NERC). 

Q.  How  many  warnings  has  the  NIP C  issued  which  were  developed  through  the  Centers's 
own  analysis  of  activity'? 

Of  the  54  tactical  warning  products  disseminated  since  the  NIPC  was  establi  shed  in 
February  1998,  all  were  developed  in  whole  or  in  part  through  the  Center’s  organic  analytical 
capability'  and  analysis  of  activity.  Some  of  these  products  were  initiated  by'  the  NIPC  (e.e.,  the 
BAT/Firkin  Worm,  also  known  as  the  ,!91 1”  Worm),  while  others  built  upon  basic  analysis  ’ 
initiated  elsewhere  (e.g.,  the  NIPC  assessments  of  Distributed  Denial  of  Sendee  tools).  We 
cannot  put  a  precise  figure  on  the  relative  contributions,  since  these  are  all  comm  unity- 
collaborative  products.  In  performing  analyses  and  issuing  warnings,  the  NIPC  works  closely 
with  other  government  agencies,  private  sector  organizations  such  as  CERT  (which  is  an  FBI 
contractor),  and  the  SANS  institute,  and  academic  institutions. 

In  addition  to  warning  products,  the  Center  has  produced  hundreds  of  non-warning 
informational  products.  Since  1998  the  NIPC  has  produced  301  daily  reports,  30  CyberNotes  (a 
summary  and  analysis  of  technical  exploi  ts  and  vulnerabilities),  5 1  Critical  Infrastructure 
Developments  reports  (a  report  on  recent  cyber-related  issues  and  incidents),  and  five  IP  Digests 
(a  periodic,  in-depth  analysis  of  cyber  threats  and  vulnerabiliti  es).  Versions  of  these  analytical 
products  go  to  private  industry,  to  the  Intelligence  Community,  other  federal  agencies  (including 
law  enforcement),  and  to  criminal  investigators. 

< 

Q:  What- other  agencies  do  you  see  playing  a  significant  role  in  the  area  of  computer  crime 
investigations?  _ 

Cyber  crime  is  an  issue  that  concerns  not  just,  the  FBI,  and  not  just  law  enforcement 
generally.  Indeed,  "cyber  crime”  in  itself  should  be  seen  as  part  of  a  broader  array  of  cyber 
threats,  including  cyber  terrorism,  cyber  espionage,  and  information  warfare,  since  all  are  closely 
related  and  often  difficult  to  distinguish  at  the  outset  of  an  incident.  As  a  result,  cyber  threats  are 
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of  great  concern  to  numerous  federal  agencies,  including  the  Defense,  Intelligence,  and  Law 
Enforcement  Communities  and  to  civilian  "Lead  Agencies”  under  FDD-63;  to  state  and  local 
governments,  including  law  enforcement;  and,  of  course,  to  the  private  sector.  It  is  because  of 
this  wide-ranging  interest  that  the  NIPC  was  established  as  an  interagency  center.  The  NIPC 
pro  vi  des  a  locus  and  mechanism  for  coordinating  the  expertise  and  roles  of  many  agencies,  and 
facilitates  infonnarion  sharing  and  operational  coordination.  Tire  NIPC  works  closely  on  ’ 
investigative  matters  with  many  law  enforcement  agencies,  including:  die  Secret  Sendee 
Internal  Revenue  Service  (IRS),  Air  Force  Office  of  Special  Investigations  (AFOSI)  Naval 
Criminal  In  vestigative  Service  (NOS),  United  States  Air  Force  Office  of  Special  Investigations 
(AFOSI),  Defense  Criminal  Investigative  Service  (DCIS),  National  Aeronautics  and  Space 
Administration  Office  of  Inspector  General  (NASA  OIG),  Department  ofEnergy  (DOE),  state 
and  local  law  enforcement,  foe  Intelligence  Community,  as  well  as  foreign  law  enforcement 
agencies  through  FBI  Legal  Attaches  (LEGATS).  *  *  ” 

Q:  Are  there  reasons,  other  than  funding,  which  have  caused  other  agencies  to  pull  their 
personnel  out  of  the  NIPC?  For  example  does  FBI  management  at  the  Center  recognize 
the  expertise  of  the  other  agencies  and  allow  them  to  fully  participate? 

One  of  the  difficulties  in  attempting  to  operate  an  interagency  Center  is  ensuring  that  all 
relevant  agencies  participate.  Agencies  have  not  received  direct  funding  to  participate  in  foe 
Center,  and  so  must  take  detailees  to  the  NIPC  out  of  existing  personnel  resources.  In  addition 
personnel  with  cyber  expertise  are  unfortunately  in  very  short  supply,  meaning  that  agencies 
must  commit  to  take  scarce  resources  and  send  them  outside  their  agencies.  Despite  these 
impediments,  numerous  agencies  have  sent  detailees  to  the  NIPC,  including:  Defense/Office  of 
the  Secretary  of  Defense;  Central  Intelligence  Agency;  National  Security  Agency;  Air  Force 
Office  of  Special  Investigations;  U.S.  Navy;  U.S.  Aimy;  US!  Postal  Service;  Defense  Criminal 
Investigative  Service;  Genera!  Services  Administration;  U.S.  Air  Intelligence  Agency; 
Department  of  Commerce,  and  foe  Tuscaloosa,  AL  Sheriff  s  office.  In  addition,  we  have  foreign 
liaison  representatives  from  two  allied  countries  who  assist  in  coordinating  international 
activities  with  our  counterparts.  A  representative  from  FAA  is  also  scheduled  to  start  at  foe  end 
of  June.  Additional  representative  from  DoD,  CIA,  and  NSA  are  also  slated  to  arrive  in  foe  near 
future.  We  are  also  expecting  representatives  from  local  Washington  area  police  departments  on 
a  part-time  basis,  ~ 

Some  agencies  were  represented  earlier  but  do  not  currently  have  representatives 
Circumstances  necessitated  foe  recall  of  foe  first  State  Department  representative.  State  agreed 
to  do  so,  and  has  committed  to  NIPC  that  it  would  replace  him  with  two  new  representatives 
DoE’s  first  representative  rotated  back  after  more  than  two  years,  NIPC*s  understanding  as  to 
why  this  representative  rotated  back  is  that  he  was  at  NIPC  for  a  lengthy  time  and  was  needed  at 
DoE  headquarters  to  assist  in  a  DOE  reorganization.  DoE  has  committed  to  replacing  foat 
detailee.  „  -  * 

Secret  Service  earlier  had  two  detailees  to  the  NIPC,  but  recalled  those  detailees  and  has 
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not  yet  committed  to  replacing  them.  Secret  Service  has  not  provided  any  written  explanation  for 
this,  but  in  oral  discussions.  Secret  Service  officials  stated  that  USSS  was  not  getting  additional 
fending  for  its  electronic  crimes  program  despite  its  participation  in  NIPC;  the  FBI  was  receiving 
more  media  attention  in  the  cyber  crime  area;  and  NIPC  had  not  "referred"  cases  to  Secret 
Service  for  investigation.  NIPC  offered  any  support  it  could  give  to  Secret  Service  in  addressing 
budget  requests;  noted  feat  NIPC  public  statements  often  referred  to  partnership  wife  USSS;  and 
offered  to  do  more  to  support  USSS  initiatives  wife  public  statements  and  case  analyses.  NIPC 
also  stated  (as  discussed  further  below-)  feat  its  role  is  not  to  create  and  "refer"  cases;  rather,  cases 
generally  originate  in  Field  Offices,  and  FBI  and  Secret  Service  field  offices  frequently  work 
computer  crime  cases  together. 

NIPC  felly  recognizes  the  value  other  agencies  bring  to  fee  cyber  crime  and  infrastructure 
protection  mission.  That  is  why  NIPC  is  an  interagency  Center,  and  has  senior  managers  from 
other  agencies  in  addition  to  investigators  and  analysts.  For  instance,  fee  MPC  Deputy  Director 
is  from  DoD/OSD;  the  Section  Chief  of  fee  Analysis  and  Warning  Section  is  from  CIA;  the 
Assistant  Section  Chief  of  the  Computer  Investigations  and  Operations  Section  is  from  Air  Force 
OSI;  the  Unit  Chief  of  fee  Analysis  and  Information  Sharing  Unit  is  from  NSA;  and  the  Unit 
Chief  of  fee  Watch  and  Warning  Unit  is  from  the  U.S.  Navy.  Secret  Service  fomrally  occupied 
the  position  of  Assistant  Section  Chief  of  the  Training,  Outreach,  and  Strategy  Section. 
Recognition  of  the  need  for  other  agency  participation  is  also  what  drives  NIPC  to  continually 
seek  additional  representatives  from  other  agencies.  It  is  also  reflected  in  the  numerous  joint 
inv  estigations  that  NIPC  and  FBI  Field  Offices  have  been  involved  in  with  other  agencies  fas 
discussed  further  below). 


Qj  How  many  criminal  investigations  have  been  referred  from  the  NTPC  to  these  other 
agencies?  Does  the  Center  have  operating  procedures  to  refer  a  case  to  another  agency'' 

I v  * 


As  a  general  matter,  the  NIPC  does  not  "refer"  cases.  Cases  are  normally  initiated  bv  a 
field  office,  whether  a  Field  Office  of  the  FBI,  the  Secret  Service,  another  federal  agency,  or  a 
state  or  local  law  enforcement  agency.  NIPC  is  the  "program  manager"  of  fee  FBI’s  computer 
intrusion  investigative  program,  and  so  receives  information  about  cases  directly  from  the  FBI 
Field  Offices.  Under  FDD  63,  other  agencies  are  also  supposed  to  report  information  about 
cyber  incidents  to  fee  NIPC.  Sometimes,  NIPC  wall  receive  fee  first  report  of  a  cyber  incident 
from  a  private  company,  a  government  agency,  or  another  source,  and  contact  fee  appropriate 
FBIField  Office.  If  another  agency  has  concurrent  investigative  jurisdiction  or  some  other  non- 
investigative  interest,  feat  agency  will  also  be  contacted  (either  by  fee  FBI  Field  Office  of  the 
NIPC).  Where  j  oint  jurisdiction  exists,  fee  FBI  field  office  may  work  jointly  wife  the  relevant 
other  agencies  (as ^  discussed  fkther  below). 


If  an  inquiry  determines  fee  complaint  does  not  fell  within  the  investigative  guidelines  of 
fee  FBI,  it  may  be  referred  by  fee  field  office  to  another  federal  agency  ox  to  a  state  or  local  law 
enforcement  agency  which  has  fee  authority  to  conduct  such  investigations,  FBI  field  offices 
develop  liaison  contacts  wife  federal,  state  and  local  agencies  investigating  similar  violations 


under  federal  or  state  statutes  and  complaints  are  disseminated  through  these  liaison  contacts. 
There  is  no  system  established  to  track  how  many  complaints  have  been  sent  front  FBI  field 
offices  to  other  law  enforcement  agencies. 

There  have  been,  however,  several  instances  in  which  the  NTPC  or  an  FBI  field  office  has 
contacted  another  agency  to  d  etermine  if  that  agency  wanted  to  conduct  an  investigation  either 
jointly  or  separately,  but  th  at  agency  declined.  A  couple  of  examples  are  listed  below. 

In  May  2000,  the  FBI’s  Detroit  Field  Office  referred  a  complaint  to  the  local  Secret 
Service  office  regarding  a  denial  of  service  attack  against  NHL.com,  going  so  far  as  to  transfer 
the  call  from  the  FBI  field  office  to  die  Secret  Service  field  office.  The  Secret  Service  told  the 
complainant  that  no  one  was  in  the  office  to  receive  the  complaint  due  to  a  visit  of  Texas 
Governor  George  W,  Basil  to  Michigan.  The  complainant  then  called  the  FBI  again  and  the 
Detroit  Field  Office  took  the  complaint  and  assigned  the  matter  for  investigation. 

Also  in  May  2000,  based  on  FBI  source  information,  the  NIPC  notified  the  USSS 
headquarters  that  there  may  be  a  vulnerability  with  the  Mute  House  Webpage  that  gave  the 
public  access  to  all  the.. files  on  that  server.  The  USSS  advised  that  the  system  administrator  mav 
already  be  aware  of  this.  Neither  the  NIPC  nor  the  FBI’s  Washington  Field  Office  has  heard  " 
back  from  the  USSS  regarding  this  matter. 

In  another  instance,  the  FBI’s  Williamsport,  Resident  Agency,  part  of  the  Philadelphia 
Field  Office,  opened  an  investigation  into  a  series  of  computer  intrusion  into  10  companies 
resulting  in  the  loss  of  approximately  28,000  credit  card  numbers.  During  the  initial 
investigation,  the  FBI  discovered  that  one  of  the  victims  located  in  Buffalo,  NY,  had  contacted 
the  Secret  Service  and  the  USSS  had  opened  a  case  pertaining  to  the  intrusion  against  the  single 
victim  company,  but  was  not  investigati  ng  tire  larger  set  of  theft  s.  The  FBI  contacted  the  Secret 
Service  Division  in  Buffalo,  NY  tp  coordinate  the  case,  since  USSS  already  had  a  pending 
investigation.  The  FBI  was  told  that  due  to  the  Security  Detail  Duties  for  the  First  Lady,  the 
USSS  would  be  unable  to  coordinate  at  the  present  time  with  the  FBI  on  the  case. 

Q.  In  previous  testimony  before  this  subcommittee  Mr.  Vatis  has  stated  that  the  NIPC  has 
referred  approximately  800  cases  for  criminal  Investigation.  How  many  of  these  800  cases 
actually  Involved  a  real  threat  to  our  nation’s  critical  infrastructure?  Would  yon 
catagorize  the  recent  Denial  of  Service  attacks  launched  last  month  as  an  attack  on  our 
nation’s  critical  infrastructure? 

'  *  • 

In  previous  testimony  before  the  sub  committee,  the  approximate  800  numb  er  of  cases 
that  Mr.  Vatis  referenced  were  not  cases  the  NIPC  “referred,”  hut  was  the  numb  er  of  computer 
intrusion,  denial  of  service,  or  virus  cases  pending  in  FBI  field  offices  at  the  time  of  testimony. 

As  of  May  1,  2000  there  were  1,072  pending  investigative  cases.. 
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The  nation  s  critical  infrastructures”  are  those  physical  and  cyber-based  systems 
essential  to  the  minimum  operations  of  the  economy  and  government,  including 
telecommunications,  energy,  banking  and  finance,  transportation,  water  systems  and  emergency 
services,  both  governmental  and  private.  One  of  the  most  difficult  aspects  of  cyber 
investigations  is  that  it  is  not  clear  at  the  outset  what  the  extent  of  the  threat,  or  the  potential 
damage  to  networiss,  is.  Each  case  must  be  thoroughly  investigated  to  determine  the  level  of 
tbreat  and  compromise.  What  seems  like  a  relatively  minor  incident  might  ton  out  to  be  very 
significant,  and  vice  versa.  This  means  that  it  is  much  more  difficult  for  field  investigators  to  use 
traditional  investigative  thresholds  in  determining  how  to  utilize  scarce  resources.  Moreover, 
computer  systems  and  networks  employ  trusted  relationships  between  other  computer  system  and 
networks,  based  upon  the  users'  pri  vileges.  If  a  computer  system  or  network  is  root-level  (or 
super  user)  access  compromised,  the  threat  potential  is  substantial,  and  could  theoretically  pose  a 
major  tbreat  to  other  trusted  systems.  This  means  that  “critical  infrastructure”  systems  are  often 
connected  with,  and  affected  by,  systems  that  are  in  and  of  themselves  not  critical. 

The  existing  NIPC  database  does  not  classify  cases  by  critical  infrastructure  at  this  time. 
Thus  of  these  1,072  cases,  there  is  no  methodology  to  determine  which  ultimately  constitute  a 
threat  to  our  nation’s  critical  infrastructure.  However,  we  can  cite  several  examples. 

The  Distributed  Denial  of  Service  (DDOS)  attacks  launched  in  February  of  this  year  are  a 
good  example  of  the  difficulty  of  categorizing  an  attack  as  an  “infrastructure”  attack  or  some 
lesser  sort  of  attack.  In  a  Distributed  Denial  of  Services  attack,  not  only  are  the  "victim”  systems 
affected,  but  also  the  thousands  of  computer  systems  and  networks  that  were,  unknowingly, 
infiltrated  and  used  to  carry  out  the  attack,  and  Internet  Service  Providers  that  were  heavily 
trafficked  during  the  attack.  All  of  the  computer  systems  and  networks  that  participated  in  the 
attack  were  compromised.  Moreover,  even  though  tire  effect  of  the  attacks  was  relatively 
ephemeral  and  brief,  the  knowledge  gained  by  analyses  of  these  attacks  is  critical  to  our  ability  to 
protect  against  more  devastating  attacks  in  the  future.  If  the  DDOS  attacks  had  been  directed  * 
against  the  major  Internet  hubs  rather  than  against  primarily  e-comnrerce  companies,  traffic  on 
the  Internet  could  have  been  paralyzed,  disrupting  several  of  the  critical  infrastructures  that  rely 
on  the  Internet  for  communication. 

Q*  Besides  Solar  Sunrise  and  Moonlight  blaze,  what  other  joint  investigations  can  you 
point  to  that  demonstrate  successful  interagency  cooperation? 

* 

Sinpe  the  founding  of  the  NIPC  in  February  1998,  there  are  numerous  cases  which  have 
demonstrated  successful  interagency  cooperation  other  than  the  significant  Solar  Sunrise  and 
Moonlight  Maze  cases.  The  importance  of  these  too  cases  should  not  be  overlooked,  however. 
Both  represent  sipificant  milestones  in  building  awareness  of  the  cyber  threat  among  federal 
agencies  and  policymakers,  demonstrated  significant  vulnerabilities  in  DoD  and  other 
government  systems,  and  presided  opportunities  to  test  and  improve  the  NIPC’s  processes  for 
interagency  coordination. 
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The  following  eases  represent  a  small  sample  of  these  cases  which  have  been 
successfully  worked  with  other  agencies: 

PJ2QS:  Numerous  Internet  commerce  sites  have  been  victimized  by  DDOS  attacks  since 
February  7, 2000,  These  DDOS  attacks  prevented  the  victims  from  offering  their  web  services 
on  the  Memet  to  legitimate  users,  A  DDOS  attack  uses  compromised  computer  networks  to 
iiood  a  victim  s  computer  network  with  massive  amounts  of  data,  which  causes  the  victim’s 
computer  network  to  become  overwhelmed  and  to  stop  operating.  The  DDOS  attack 
investigation  are  investigations  in  seven  FBI  field  offices,  five  overseas  Legal  Attache  offices 
other  government  agencies  such  as  NASA  as  well  as  the  Royal  Canadian  Mounted  Police,  ’ 
Reflecting  the  extraordinary  level  of  cooperation  on  these  investigations,  on  April  15, 2000  the 
Canadian  officials  arrested  a  juvenile  charging  him  with  one  of  the  attacks. 

Qi  radon  On  March  1, 2000,  a  computer  hacker  using  the  name,  "Curador",  allegedly 
compromised  multiple  E-commerce  websites  in  the  US,  Canada,  Thailand,  Japan  and  the 
United  Kingdom,  and  apparently  stole  as  many  as  28,000  credit  card  numbers.  Thousands  of 
credit  card  numbers  and  expiration  dates  were  posted  to  various  Internet  websites  On  March  9 
2000,  IntemetNews  reported  that  Curador  stated,  "Law  enforcement  couldn’t  hack  their  way  out 
of  a  wet  paper  bag.  They're  people  who  get  paid  to  do  nothing.  They  never  actually  catch 
anybody.”  After  an  extensive  international  investigation,  on  March  23, 2000,  the  FBI  assisted 
theDyfed  Powys  (UK)  Police  Service  in  a  search  at  the  residence  of  Curador;  Curador,  age  18, 

V?’. a!on§  with  m  aPParent  co -conspirator  under  the  Computer  Misuse  Act 
1 990.  L  nder  United  Kingdom  lav,',  both  males  have  been  dealt  with  as  adults.  Loss  estimates 
are  still  being  determined, 

-  This  case  was  predicated  on  the  investigative  work  by  the  Dyfed  Powys  Police  Service 
the  Federal  Bureau  of  Investigation,  internet  security  consultants,  the  Royal  Canadian  Mounted 
Po  ice,  and  the  international  banking  and  credit  card  industry'.  Tins  case  illustrates  the  benefits 
of  law  enforcement  and  private  industry,  around  the  world,  working  together  in  partnership  on 
computer  crime  investigations,  * 


Burns.  In  August  1998,  the  FBI  initiated  an  investigation  on  an  individual  only  known  as 
"zyklon,”  who  conducted  numerous  computer  intrusions  to  various  computer  systems  causing 
damages  to  websites  and  system  files.  The  case  was  worked  in  cooperation  with  the  Virginia 
State  Police.  The  investigation  identified  zyklon  to  be  Eric  Bums  of  Shoreline,  Washington.  In 

f,  9*  f°Il0Wing  20  executi0Q  of  a  search  warrant,  Bums  confessed  to  the  intrusions  In 

May  1999,  Bums  also  gamed  unauthorized  access  and  defaced  the  webpage  for  the  White  House 
website.  At  that  point  the  FBI  began  working  with  the  U.S.  Secret  Service  on  the  case.  In 
September  1999,  Bums  pleaded  guilty  to  one  count  for  violation  of  Title  18  USC  Section  1030 
(Computer  Fraud  and  Abuse)  for  one  of  the  1998  intrusions.  In  the  plea  agreement.  Bums  also 
admitted  his  criminal  activity  rate  several  other  intrusions  including  the  White  House  website  In 

J^VoTnber  i9"’ Buras  was  scntcaced  to  15  mon&s  in  prison,  3  years  supervised  release  and 
$36,240  m  restitution  and  a  $100  fine. 
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Xdfero:  This  investigation  was  worked  jointly  with  the  Middletown  Rhode  Island  Police 
Department,  the  state  Office  of  the  Inspector  General  (GIG),  National  Aeronautics  and  Space 
Administration  (NASA),  and  the  FBI.  Sean  Trifero  compromised  various  company  and 
University  computer  systems,  including  systems  maintained  by  Harvard  University,  Amherst 
Co  lege,  Internet  Services  of  Central  Florida,  Aliant  Technologies,  Arctic  Slope  Regional 
Corporation  and  Barrows  Cable  Company,  He  would  utilize  these  compromised  systems  to 
establish  web  pages,  E-Mail  and  Internet  Relay  Chat  (IRQ  Groups  in  the  background  of  the 
victim, s  ^P^^systjm  Infer©  would  also  provide  others  wife  access  to  these  compromised 
systems.  On  10/6/1998,  Trifero  entered  a  guilty  plea  in  fee  District  of  Rhode  Island  in 
connection  wife  this  matter.  On  2/22/1999,  Trifero  was  sentenced  in  connection  with  his  guilty 
plea  to  five  counts  of  violating  Titlelg  United  States  Code,  Section  1030.  He  was  sentenced  to: 

months  plus  1  day  in  jail;  $32,650.54  in  restitution;  S500  special  assessment;  three  years 
supervised  release;  five  hours/wk  community  service  for  36  months;  use  of  the  Internet  but  no 

contact  with  members  of  any  hacking/cracking  group. 

Msmm:  Throughout  1996,  National  Oceanic  and  Atmospheric  Administration  (NOAA) 
suffered  several  computer  intrusions  which  were  also  linked  to  intrusions  occurring  a  the 

tartiwfm*  SH  (NASA)'  ^  inirusions  coattacd 

through  1997.  The  FBI  worked  the  ease  jointly  with  NOAA.  NASA,  and  the  Canadian 

authorities  and  identified  the  subject,  Jason  G.  Mewhiney,  who  resided  in  Canada.  The  original 

damage  assessment  feat  Mewhiney  had  caused,  exceeded  $40,000.  In  April  1999,  Jason  G. 

Mewhiney  was  indicted  by  Canadian  authorities.  In  January  2000,  Mewhiney  pleaded  guilty  to 

counts  of  intrusions  which  included  violations  spanning  from  May  1996  through  Aorii  1997 

of  destroyed/altered  data  and  intrusions  with  the  intent  to  damage.  In  the  Canadian  Superior 

Court  of  Justice,  Mewhiney  was  sentenced  to  6  months  in  jail  for  each  of  the  counts  to  ran 
concurrently.  ' 

lliss:  In  February,  1998,  the  FBI  opened  an  investigation  to  assist  the  U.S.  Air  Force  and  US. 
^avy  regarding  multiple  computer  intrusions.  The  case  was  worked  jointly  with  the  U  S  Naval 
Cnmraal  Investigative  Service  and  Florida  State  Attorney's  Office  in  Jacksonville,  FL.  *  The 
subject  was  identified  as  Jesse  Le  Bliss,  a  student  of  the  University  of  North  Florida.  On  August 

2I’- 1  !S^1SS?eaded  §mty  t0  °ne  felony  count  violation  of  Florida  State  Statute  815  06 

entitled  Offenses  Against  Computer  Users,  On  September  19, 1998,  Bliss  was  sentenced  in  fee 
Fourth  Judicial  Circuit,  S  tate  of  Florida,  to  six  months  house  arrest  followed  by  three  vears 
probation,200hourcof  community  sertdce,  and  a  written  letter  of  apology  to  fee  Commandant 
of  the  United  States  Marine  Corps, 

CD, Universe:  One  pending  case  being  worked  by  the  FBFs  New  Haven  Division  and  the  U.S. 
Secret  Service  has  been  widely  reported  in  the  press,  due  to  statements  made  to  reporters  by  the 
alleged  perpetrator.  In  December  1999,  fee  FBFs  New  Haven  Division  opened  a  case  into  fee 
mfiusions  into  fee  computers  of  CD  Universe,  an  on-line  music  seller,  and  fee  theft  of  customers’ 
credit  card  numbers  and  a  related  extortion  attempt  Because  of  fee  credit  card  aspect  fee  FBI 
called  the  USSS  to  ask  if  USSS  wanted  to  investigate  jointly.  The  USSS  declined.  In  January 
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2000,  the  New  York  Times  ran  a  front  page  story  about  the  case,  based  on  conversations  between 
the  reporter  and  the  alleged  perpetrator.  Subsequently,  USSS  called  the  FBI  back  and  requested 
to  work  the  case  jointly.  That  case  is  still  pending.  • 


Other 

There  are  other  investigations  that  are  being  conducted  with  other  agencies,  however 
further,  details  may  adversely  impact  the  investigation  due  to  their  pending  status.  There  are 
currently  47  pending  investigative  cases  which  are  being  worked  jointly  between  the  FBI  and  the 
multiple  entities  of  the  Department  of  Defense.  An  additional  58  cases  were  investigated  jointly 
with  other  entities  that  are  now  in  closed  status. 
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Senator  Fdnstem: 

I.  Under  Presidential  Decision  Directive  63  (PDD  63),  the  .[sic...  NIPCJ...  is  supposed  to 
take  the  lead  in  naming  of,  investigating,  and  responding  to  threats  to  or  attacks  on  this 
country  s  critical  infrastructures.  NTPC  includes  representatives  from  the  FBI  and  other 
law  enforcement  agencies.  Yon  testified  that  the  NIPC  has  improved  the  FBI's  ability  to 
fight  cybercnme  and  that  the  FBI  closed  912  cybercrime  cases  in  the  Fiscal  Year  1999  and 
had  834  pending  cybercrune  cases  that  yean 

How  many  of  the  912  closed  cases  involved  threats  to  or  attacks  on  our  nations's  critical 
infrastructures?  Were  these  cases  really  a  threat  to  our  national  security?  What  about  the 

pending  cases?  How  many  involved  threats  to  or  attacks  on  oar  nation's  critical 
infrastructures? 

.  yhe  nation’s  “critical  infrastructures”  are  those  physical  and  cyber-based  systems 
essential  to  the  minimum  operations  of  the  economy  and  government,  including 
te  eeomroumcations,  energy,  banking  and  finance,  transportation,  water  systems  and  emergency 
services,  both  governmental  and  private.  One  of  the  most  difficult  aspects  of  cyber  ' 

investigations  ts  that  it  is  not  clear  at  the  outset  what  the  extent  of  the  threat,  or  the  potential 
damage  to  networks,  is.  Each  case  must  be  thoroughly  investigated  to  determine  the  level  of 
threat  and  compromise.  What  seems  like  a  relatively  minor  incident  might  turn  out  to  fee  very 
significant,  and  vice  versa.  This  means  that  it  is  much  more  difficult  for  field  investigators  to  use 
traditional  investigative  thresholds  in  determining  how  to  utilize  scarce  resources.  Moreover 
computer  systems  and  networks  employ  trusted  relationships  between  other  computer  system  and 
ne  vorks,  based  upon  the  users'  privileges.  If  a  computer  system  or  network  is  root-level  for 
super  user)  access  compromised,  the  threat  potential  is  substantial,  and  could  theoretically  pose  a 
major  threat  to  other  trusted  systems.  This  means  that  ‘'critical  infrastructure"  systems  are  often 
connected  with,  and  affected  by,  systems  that  are  in  and  of  themselves  not  critical 

The  existing  NIPC  database  does  not  classify  cases  by  critical  infrastructure  at  this  time. 
Thus,  there  is  no  methodology  to  determine  which  eases  ultimately  constitute  a  threat  to  our 
nation’s  cntical  infrastructure. 

The  DistributedDemal  of  Sendee  (DDOS)  attacks  launched  in  February  of  this  year  are  a 
good  example  ofthe  difficultyof  categorizing  an  attack  as  an  “Infrastructure”  attack  or  some 
st°?ofafac^  111 2  Distributed  Denial  of  Sendees  attack,  not  only  are  the  ''victim"  systems 
affected,  but  also  the  thousands  of  computer  systems  and  networks  that  ware,  unknowingly 
infiltrated  and  used  to  cany  out  the  attack,  and  Internet  Service  Providers  that  were  hem! y 
trafficked  during  She  attack.  All  of  the  computer  syst  ems  and  networks  that  participated  in  the 
attack  were  compromised.  Moreover,  even  though  the  effect  ofthe  attacks  was  relatively 
ep  emeral  and  brief,  the  knowledge  gained  by  analyses  of  these  attacks  is  critical  to  our  ability  to 
protect  against  more  devastating  attacks  in  the  future.  If  the  DDOS  attacks  had  been  directed 
against  the  major  Internet  hubs  rather  than  against  primarily  e-commerce  companies,  traffic  on 
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the  Internet  could  have  been  paralyzed,  disrupting  several  of  the  critical  infrastructures  that  rely 
on  die  Internet  for  communication. 

2*  In  testimony  last  February  16,  you  said  that  the  FBI  was  producing  "fast-developing 
leads’  and  that  a  break  in  the  case  was  imminent.  A  couple  of  weeks  later,  Michael  Vatis, 
director  ofNIPC,  suggested  that  in  fact  agents  were  making  slow  progress  in  the  case. 

How  would  yon  assess  progress  la  the  case  now? 

In  fact,  the  testimonies  of  FBI  Director  Freeh  and  NIPC  Director  Vatis  were  entirely 
consistent.  Both  cited  the  difficulties  in  conducting  cyber  crime  investigations,  but  both  also 
expressed  optimism  about  the  prospects  for  a  successful  resolution  of  the  case.  Director  Freeh’s 
February  16  testimony  for  the  record  contained  the  following  remarks  about  the  DDOS 
investigation: 

On  February^  8, 2000,  the  FBI  received  reports  that  Yahoo  had  experienced  a 
denial  of  sendee  attack.  In  a  display  of  the  close  cooperative  relationship  the 
N1PC  has  developed  with  the  pri  vate  sector,  in  the  days  that  followed,  several 
other  companies  also  reported  denial  of  service  outages.  These  companies 
cooperated  with  our  National  Infrastructure  Protection  and  Computer  Intrusion 
squads  in  the  FBI  field  offices  and  provided  critical  logs  and  other  information. 

Still,  the  challenges  to  apprehending  the  suspects  are  substantia!.  In  many  cases, 
the  attackers  used  “spoofed”  IP  addresses,  meaning  that  the  address  that  appeared 
on  the  target’s  log  was  not  the  true  address  of  the  system  that  sent  the  messages. 

The  resources  required  in  these  investigations  can  be  substantial.  Already  we 
have  five  FBI  field  offices  with  cases  opened  :  Los  Angeles,  San  Francisco, 

Atlanta,  Boston,  and  Seattle.  Each  of  these  offices  has  victim  companies  in  its 
jurisdiction.  In  addition,  so  far  seven  field  offices  are  supporting  the  five  offices 
that  have  opened  investigations.  The  NTPC  is  coordinating  the  nationwide 
investigative  effort,  performing  technical  analysis  of  logs  from  victims  sites  and 
Internet  Service  Providers,  and  providing  all-source  analytical  assistance  to  field 
offices.  Agents  from  these  offices  are  following  up  literally  hundreds  of  leads. 

While  the  crime  may  be  high  tech,  investigating  it  involves  a  substantial  amount 
of  traditional  police  work  as  well  as  technical  work.  For  example,  in  addi  tion  to 
following  up  leads,  MFC  personnel  need  to  review  an  overwhelming  amount  of 
log  information  received  from  the  victims.  Much  of  this  analysis  needs  to  be  done 
manually.  Analysts  and  agents  conducting  this  analysis  have  been  drawn  off 
other  case  work.  In  the  coming  years  we  expect  our  case  load  to  substantially 
increase.  (Emphases  added.)  '  V 

NIPC  Director  Vatis’  February  29  testimony  for  the  record  contained  the  following 
statement  about  the  DDOS  investigation: 
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.  0n  Februaf>"  g>  2000,  the  NIPC  received  reports  that  Yahoo  had 
experienced  a  denial  of  sendee  attack.  In  a  display  of  the  close  cooperative 
relationship  that  we  have  developed  with  the  pri  vate  sector,  in  the  days  that 
followed,  several  other  companies  (including  Cable  News  Network,  eBay 

ZDNH).  Ao  reported  denial  of  service  outages  to 
the  NIPC  or  FBI  field  offices.  These  companies  cooperated  with  us  by  providing 
critical  logs  and  other  information.  Still,  the  challenges  to  apprehending  the  * 

•  susPe are  substantial-  In  many  eases,  the  attackers  used  “spoofed”  IP  addresses 
meaning  that  the  address  that  appeared  on  the  target’s  log  was  not  the  true  address  ’ 
of  the  system  that  sent  the  messages.  In  addition,  many  victims  do  not  keep 
complete  network  logs.  r 

The  resources  required  in  an  investigation  of  this  type  are  substantial 
Companies  have  Been  victimized  or  used  as  “hop  sites”  m  numerous  places  across 
the  country  meaning  that  we  must  deploy  special  agents  nationwide  to  work  leads 
We  currently  have  seven  FBI  field  offices  with  cases  opened  and  all  the  remaining 
oftices  are  supporting  the  offices  that  have  opened  cases.  Agents  from  these 
offices  are  following  up  literally  hundreds  of  leads.  The  NIPC  is  coordinating  toe 
nationwide  investigative  effort,  performing  technical  analysis  of  logs  from  victims 
sites  and  Internet  Sendee  Providers  (ISPs),  and  providing  ail-sour^  analytical 
assistance  to  field  offices.  Moreover,  parts  of  the  evidentiary  trail  have  led 
overseas,  requiring  us  to  work  with  our  foreign  counterparts  in  several  countries 
through  our  Legal  Attaches  (LEGATs)  in  US.  embassies. 

While  the  crime  may  be  high  tech,  investigating  it  involves  a  substantial 
amount  of  traditional  investigative  work  as  well  as  highly  technical  work. 

Interviews  of  network  operators  and  confidenti  al  sources  can  provide  very  useful 
information,  which  leads  to.  still  more  interviews  and  leads  to  follow-up.  And 
victim  sites  and  ISPs  provide  an  enormous  amount  of  log  information  that  needs  to 
be  processed  and  analyzed  fay  human  analysts. 

Despite  these  challenges,  1  am  optimistic  that  the  hard  work  of  our  agents 
analysts  and  computer  scientists;  the  excellent  cooperation  and  collaboration  we 
have  with  private  industry  and  universities;  and  the  teamwork  we  are  engaged  in 
with  foreign  partners  will  in  the  end  prove  successful  (Emphases  added.) 

M  “f, nriimca&ha.  conducted  in  close  coordination  with  the  Royal  Canadian 
Mounted  Police,  very  quickly  bad  resulted  to  the  identification  of  one  subject  in  Canada  Because 

£ S??*1  by  ““  ECMP  *>  DDOSca.se  and  in  another  matter 
that  came  to  light  during  the  RCMP  s  investigation,  the  subject  could  not  be  immediately  arrested, 

RCMP  ‘  ’  P10®"®001^  n°t  be  discussed  publicly.  However,  on  April  15.4c 

executed  a  search  warrant  and  arrested  a  juvenile  charging  him  wife  one  of  the  attacks. 
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We  would  therefore  assess  the  progress  in  this  ease  as  substantial  and,  indeed 
unprecedented  m  a  ease  of  tlm  scope  and  nature.  The  investigation  continues  into  the  attacks  on 
DDOS  victims,  and  we  believe  good  progress  continues  to  be  made. 

3,  In  twfimony  last  February  16,  you  suggested  that  the  FBI’s  resources  ’’are  stretched 
paper-thm  because  of  the  lack  of  high-ealtber  government  forensic  computer  experts. 

How  much  has  this  contributed  to  the  government’s  lack  of  success  in  catching  the 


..  M  cussed  &ove,  substantial  progress  in  fact  has  been  made  in  the  DDOS  investigation 
with  one  subject  already  identified  in  Canada.  6  ’ 


,,  ^  ^at  f Vf a *e  exposive  Srmvl?1 511  computer  crimes,  our  existing  resources  both 

le  Computer  Analysis  Response  Team  and  in  the  MFC  and  the  related  field  office  National 
Infrastructure  Protection  and  Computer  Intrusion  Program  are  indeed  stretched  paper  thin. 


m 


Investigation  i 

*  — - - *•*>»« v,v  «««"*  «  vwHipmer  ^sucn  as  a  drug  trafficker's 

accounts)  by  conducting  computer  forensic  examinations  on  seized  media.  The  Lab’s  technically 
trained  agents  develop,  deploy,  and  support  equipment  to  perform  Title  ill  and  FISA  intercenfio-s 
of  data  communications  on  the  Internet.  Staff  in  both  of  these  areas  (forensics  and  engineering  " ' 
support)  is  extremely  stretched  because  these  agents  are  tasked  with  providing  support  not  onl  y 

for  cyber  crimes,  but  all  traditional  crimes  in  which  digital  evidence  may  be  meseot  or  data 
interception  required. 

The  FBI’s  CART  program,  consisting  of  agents  and  analysts  who  examine  digital  media! 
in  order  to  gather  evidence,  is  not  able  to  keep  up  with  the  increasing  workload.  The  following  is 
a  summary  of  current  and  future  trends  assuming  that  the  FBI  Laboratory  is  funded  for  all 
pending  budget  requests; 


CART  Capacity  and  Backlog 


Year 

* 

FIE  Staffing 

Capacity 

Exam  Requests  '  Case  Backlog 

Backlog 

* 

* 

1999 

95 

1900 

3500 

1600 

Time 

(Months) 

10.1 

2000 

104 

2080 . 

5000 

2920  - 

16,8 

2001 

.....  154 

3080 

6000 

2920 

11.4  ■ 

2002 

213 

4260 

8500 

4240 

11.9 

43 
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In  addition,  the  FBFs  Laboratory  Division  currently  provides  support  not  only  for  FBI 

cases,  but  also  for  the  Drug  Enforcement  Administration  and  the  Immigration  and  Naturalization 
Service. 

_  The  MXPC  and  the  field  office  NIPCIP  squads  are  responsible  for  conducting 
investigations  of  cyber  attacks,  including  computer  intrusions,  viruses,  and  denials  of  service. 

The  NIPC  currently  has  193  FBI  Special  Agents  xn  the  field  offices  investigating  approximately 
1 200  computer  intrusion  and  other  <SNIPCIP”  cases.  Only  16  Field  Offices  have  full  squads  of 
seven  or  more  agents.  The  other  field  offices  have  only  1  to  5  agents,  who  are  responsible  for  not 

only  cyber  investigations,  but  also  for  industry  liaison,  the  InfiaGard  Initiative,  the  Key  Asset . 

Initiative,  and  support  to  other  investigative  programs.  Further,  the  NIPC  lacks  sufficient 
computer  scientists  and  analysts  to  support  the  field  office  investigations.  For  instance,  it  has 
only  7  network  analysts/electrical  engineers  to  support  investigations  such  as  DDOS  attacks. 

The  MFC’s  and  Field  Office  resources  have  remained  relatively  static.  The  NIPC 
Headquarters  budget  for  fiscal  years  99-01  has  been  as  follows: 


Fiscal  Year 
1999 


2000 


Budget  Authority 

29,057,000  (included  one-year  funding  of  $1 0 
million  for  special  contingencies  in  Attorney 
General’s  Counter-terrorism  Fund) 

19,855,000 


2001  requested 


20,396,000 


Meanwhile,  our  pending  case  load  has  grown  rapidly. 


Fiscal  Year 
1998 


Pending  Case  Load  at  end  of  fiscal  year 
601 


1999  ^  801 

2000  (as  of  May  I  )  1 072 


Clearly,  then,  resources  haw  not  kept  pace  wife  the  crime  problem. 

•  Evidence  feathering  for  computer  intrusions  mandates  a  prompt  response  because  the 

digital  evidence  trail  can  disappear  so  quickly.  The  complexity  of  documenting,  examining  and 
analyzing  the  tremendous  amount  of  information  that  is  necessarily  collected  m  these  types  of 
eases  and  its  very  technical  nature  requires  investigators,  examiners,  and  analysts  with  extremely 
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specific  skills  and  experience.  Because  of  the  technical  nature  of  this  crime,  it  is  difficult,  if  not 
impossible,  to  temporarily  assign  additional  Special  Agents  to  an  investigation  since  a  special 
technical  skill  set  is  required  to  investigate  such  matters. 

Staff  shortages  impede  not  only  our  ability  to  conduct  investigations  adequately,  but  also 
to  quickly  obtain  information,  conduct  analyses,  and  craft  and  issue  appropriate  warnings  and 
alerts.  This  makes  the  Indications  and  Warning  mission  much  more  difficult  to  perform. 

4.  Some  have  argoed  that  the  high-profile  February’  attacks  on  Yahoo,  eBay,  and 
other  companies  were  just  a  diversion,  allowing  the  hackers  to  focus  on  making  smaller, 
intrusive  attacks  on  smaller  sites. 

Have  you  found  any  evidence  for  this  contention? 

No.  There  are  individuals  and  groups  who  do  focus  on  planning  and  executing  more 
intrusive  attacks,  often  for  the  sake  of  stealing  information  or  money,  but  we  have  not  seen  any 
correlation  between  such  intrusions  and  the  February  DDOS  attacks, 

S,  Why  don’t  you  think  industry  can  solve  this  problem  itself? 


The  Internet  was  not  designed  with  security  as  the  foremost  consideration.  Moreover, 
until  very  recently,  security  was  not  a  major  priority  of  either  hardware/sofhvare  manufacturers  or 
consumers.  As  a  result,  networks  are  still  rife  with  vulnerabilities.  Improving  security  on  die 
Internet  is  thus  first  and  foremost  the  responsibility  of  industry.  Government  must  protect  its  own 
systems,  and  can  assist  industry  by  providing  information  about  threats  and  vulnerabilities  that  we 
are  aware  of,  and  the  NIPC  does  that.  But  it  is  industry's  responsibility  to  secure  privately  owned 
systems. 


Even  if  systems  were  more  secure,  however,  there  would  inevitably  be  some  amount  of 
computer  crime  committed  on  the  Internet  ~  including  not  just  intrusions,  denials  of  service,  and 
viruses,  but  also  traditional  crimes  perpetrated  over  the  Internet  such  as  fraud  and  dissemination 
of  child  pornography  .  As  long  as  crime  exists,  the  public  will  expect  law  enforcement  to 
investigate  and  apprehend  file  perpetrators.  And  effective  law  enforcement  is  a  key  element  in 
any  strategy  to  deter  further  criminal  activity.  Thus,  industry  and  law  enforcement  must  work 
closely  together. 


6a.  How  big  a  problem  is  Hits  for  the  FBI?  Bo  you  believe  that  there  are  iraportant  cyber 
attacks  that  are  never  investigated  by  law  enforcement  because  the  attacked  companies 
refuse  to  report  them?  •  ..  .  < 

The  vulnerabilities  that  permeate  the  industry  are  a  big  problem  for  the  FBI  and  other  law 
enforcement  agencies  because  they  make  it  so  easy  for  crimes  to  be  committed.  This  accounts  in 
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1.  Of  the  800  cases  referred  for  criminal  investigation  to  FY 1999  from  the  NIPC,  what 
percentage  of  these  cases  were  referred  to  other  agencies,  other  than  the  FBI,  for  continued 
investigation  and  possible  criminal  prosecution? 

As  a  general  matter,  the  NIPC  does  not  "refer"  cases.  Cases  are  normally  initiated  by  a 
held  office,  whether  a  Field  Office  of  the  FBI,  die  Secant  Service,  another  federal  agency,  or  a 
state  or  local  law  enforcement  agency.  NIPC  is  the  "program  manager"  of  the  FBI’s  compu  ter 
intrusion  Investigative  program,  and  so  receives  information  about  cases  directly  from  fee  FBI 
Field  Offices.  Under  FDD  63,  other  agencies  are  also  supposed  to  report  information  about  cyber 
incidents  to  fee  NIPC  Sometimes,  NIPC  will  receive  fee  first  report  of  a  cyber  incident  from  a 
private  company,  a  government  agency,  or  another  source,  and  contact  the  appropriate  FBI  Field 
Office.  If  another  agency  has  concurrent  investigative  jurisdiction  or  some  other  non- 
mvestigative  interest,  feat  agency  will  also  be  contacted  (either  by  fee  FBI  Field  Office  of  the 
NIPC).  Where  joint  jurisdiction  exists,  the  FBI  field  office  may  work  jointly  with  fee  relevant 
other  agencies  (as  discussed  further  below). 

i*  *  V 

If  an  inquiry  determines  the  complaint  does  not  fall  within  the  investigative  guidelines  of 
fee  FBI,  it  may  be  referred  by  the  field  office  to  another  federal  agency  or  to  a  state  or  local  law 
enforcement  agency  which  has  fee  authority  to  conduct  such  investigations.  FBI  field  offices 
develop  liaison  contacts  with  federal,  state  and  local  agencies  investigating  similar  violations 
under  federal  or  state  statutes  and  complaints  are  disseminated  through  these  liaison  contacts. 
There  is  no  system  established  to  track  how  many  complaints  have  been  sent  from  FBI  field 
offices  to  other  law  enforcement  agencies. 

There  have  been,  however,  several  instances  in  which  fee  MFC  or  an  FBI  field  office  has 
contacted  another  agency  to  determine  if  feat  agency  wanted  to  conduct  an  investigation  either 
jointly  or  separately,  but  feat  agency  declined.  A  couple  of  examples  are  listed  below. 

In  May  2000,  fee  FBI's  Detroit  Field  Office  referred  a  complaint  to  the  local  Secret 
Service  office  regarding  a  denial  of  service  attack  against  NHL.com,  going  so  far  as  to  transfer  fee 
call  from  the  FBI  field  office  to  the  Secret  Service  field  office.  The  Secret  Service  told  the 
complainant  feat  no  one  vras  in  fee  office  to  receive  the  complaint  due  to  a  visit  of  Texas 
Governor  George  W,  Bush  to  Michigan.  The  complainant  then  called  fee  FBI  again  and  fee 
Detroit  Field  Office  took  the  complaint  and  assigned  fee  matter  for  investigation. 

Also  in  May  2000,  based  on  FBI  source  information,  fee  NIPC  notified  fee  USSS 
headquarters  feat  there  may  be  a  vulnerability  wife  the  White  House  Webpage  feat  gave  the 
public  access  to  all  fee  files  on  feat  server.  The  USSS  advised  feat  fee  system  administrator  may 
already  be  aware  of  this.  Neither  the  NIPC  nor  the  FBI’s  Washington  Field  Office  has  heard  back 
from  fee  USSS  regarding  this  matter. 
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In  another  instance,  the  FBI’s  Williamsport,  Resident  Agency,  part  of  the  Phi  ladelphia 
Field  Office,  opened  an  investigation  into  a  series  of  computer  intrusion  into  10  companies 
resulting  in  the  loss  of  approximately  28,000  credit  card  numbers.  During  the  initial 
investigation,  the  FBI  discovered  that  one  of  the  victims  located  in  Buffalo,  NY,  had  contacted  the 
Secret  Service  and  the  USSS  had  opened  a  case  pertaining  to  the  intrusion  against  the  single 
victim  company,  but  was  not  investigating  the  larger  set  of  thefts.  The  FBI  contacted  the  Secret 
Service  Division  in  Buffalo,  NY  to  coordinate  the  ease,  since  USSS  already  had  a  pending 
investigation.  The  FBI  was  told  that  due  to  the  Security  Detail  Duties  for  the  First  Lady,  the 
USSS  would  be  unable  to  coordinate  at  die  present  time  with  the  FBI  on  the  case. 

In  addition,  the  FBI  has  worked,  and  continues  to  work,  many  investigations  jointly  with 
other  agencies.  Two  notable  examples  include  Solar  Sunrise  and  Moonlight  Maze.  Both  cases 
involved  extensive  intrusions  into  Department  of  Defense  and  other  government  agency  computer 
networks.  The  investigations  involved  an  NlPC-coordinated  investigation  involving  numerous 
law  enforcement,  intelligence,  and  defense  agencies,  as  well  as  foreign  law  enforcement  agencies. 

Beyond  those  examples,  the  following  are  other  instances  of  joint  investigations. 

DDOS:  Numerous  Internet  commerce  sites  have  been  victimized  by  DDOS  attacks  since 
February  7, 2000.  These  DDOS  attacks  prevented  the  victims  from  offering  their  web  sendees  on 
the  Internet  to  legitimate  users.  A  DDOS  attack  uses  compromised  computer  networks  to  "flood” 
a  victim  s  computer  network  with  massive  amounts  of  data,  which  causes  the  victim's  computer 
network  to  become  overwhelmed  and  to  stop  operating.  The  DDOS  attack  investigation  are 
investigations  in  seven  FBI  field  offices,  five  overseas  Legal  Attache  offices,  oilier  government 
agencies  such  as  NASA,  as  well  as  the  Royal  Canadian  Mounted  Police!  Reflecting  the 
extraordinary  level  of  cooperation  on  these  investigations,  on  April  15, 2000,  the  Canadian 
officials  arrested  a  juvenile  charging  him  with  one  of  the  attacks. 

Cpradpri  On  March  1, 2000,  a  computer  hacker  using  the  name,  "Curador”,  allegedly 
compromised  multiple  E-commerce  websites  in  the  U.S.,  Canada,  Thailand,  Japan  and  the  United 
Kingdom,  and  apparently  stole  as  many  as  28,000  credit  card  numbers.  Thousands  of  credit  card 
numbers  and  expiration  dates  were  posted  to  various  Internet  websites.  On  March  9, 2000, 
IntemetNews  reported  that  Curador  stated,  "Law  enforcement  couldn't  hack  their  way  out  of  a  wet 
paper  bag.  They're  people  who  get  paid  to  do  nothing.  They  never  actually  catch  anybody."  After 
an  extensive  international  investigation,  on  March  23, 2000,  the  FBI  assisted  the  Dyfed  Powys 
(UK)  Police  Service  in  a  search  at  the  residence  of  Curador;  Curador,  age  18,  was  arrested  in  the 
UK,  along  with  an  apparent  co-conspirator  under  the  Computer  Misuse  Act  1990.  Under  United 
Kingdom  law,  both  males  have  been  dealt  with  as  adults.  Loss  estimates  are  still  being 
determined.  •  '  TT 

This  case  was  predicated  on  the  investigative' work  by  the  Dyfed  Powys  Police  Service, 
the  Federal  Bureau  of  Investigation,  Internet  security  consultants,  the  Royal  Canadian  Mounted 
Police,  and  the  international  banking  and  credit  card  industry.  This  case  illustrates  the  benefits  of 
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law  enforcement  and  private  industry,  around  the  world,  working  together  in  partnership  on 
computer  crime  investigations.  '  k  ‘ 

SmB£»  In  August  1998,  the  FBI  initiated  an  investigation  on  an  individual  only  known  as 
zyklon, 1  who  conducted  numerous  computer  intrusions  to  various  computer  systems  causing 
damages  to  websites  and  system  files.  The  case  was  worked  in  cooperation  with  the  Virginia 
State  Police,  Hie  investigation  identified  zyklon  to  he  Eric  Bums  of  Shoreline,  Washington.  In 
February  1 999,  following  an  execution  of  a  search  warrant.  Bums  confessed  to  the  intrusions.  In 
May  1999,  Bums  also  gained  unauthorized  access  and  defaced  the  webpage  for  the  White  House 
website.  At  that  point  the  FBI  began  working  with  the  U.S.  Secret  Service  on  foe  case.  In  ^ 
September  1999,  Bums  pleaded  guilty  to  one  count  for  violation  of  Title  18  USC  Section  103  0 
(Computer  Fraud  and  Abuse)  for  one  of  the  1998  intrusions.  In  the  plea  agreement.  Bums  also 
admitted  his  criminal  activity  into  several  other  intrusions  including  the  White  House  website.  In 
November  1999,  Bums  was  sentenced  to  15  months  in  prison,  3  years  supervised  release  and  * 
$36,240  In  restitution  and  a  $  100  fine, 

Trifero:  This  investigation  was  worked  jointly  with  the  Middletown  Rhode  Island  Police 
Department,  the.state  Office  of  the  Inspector  General  (OIG),  National  Aeronautics  and  Space 
Administration  (NASA),  and  the  FBI.  Sean  Trifero  compromised  various  company  and 
University  computer  systems,  including  systems  maintained  by  Harvard  University,  Amherst 
College,  Internet  Services  of  Central  Florida,  Aliant  Technologies,  Arctic  Slope  Regional 
Corporation  and  Barrows  Cable  Company.  He  would  utilize  these  compromised  systems  to 
establish  web  pages,  E-Mail  and  In  ternet  Relay  Chat  (IRC)  Groups  in  the  background  of  the 
victim  s  computer  system.  Trifero  would  also  provide  others  with  access  to  these  compromised 
systems.  On  1 0/671998,  Trifero  entered  a  guilty  plea  in  the  District  of  Rhode  Island,  in 
connection  with  tins  matter.  On  2/22/1999,  Trifero  was  sentenced  in  connection  with  his  guilty 
plea  to  five  counts  of  violating  Title!  S  United  States  Code,  Section  1030.  He  was  sentenced  to- 
12  months  plus  1  day  in  jail;  S32, 650.54  in  restitution;  $500  special  assessment;  three  yearn 
supervised  release;  five  hours/wk  community  service  for  36  months;  use  of  the  Internet,  but  no 
contact  with  members  of  any  hacking/cracking  group. 

Mewhiney:  Throughout  1996,  National  Oceanic  and  Atmospheric  Administration  (NGAA) 
suffered  several  computer  intrusions  which  were  also  linked  to  intrusions  occurring  a  the  National 
Aeronautics  and  Space  Administration  (NASA).  These  computer  intrusions  continued  through 
1997.  The  FBI  worked  the  ease  jointly  with  NOAA,  NASA  and  the  Canadian  authorities  and 
identified  fhe  subject,  Jason  G.  Mewhiney,  who  resided  in  Canada,  The  original  damage 
assessment  that  Mewhiney  had  caused,  exceeded  $40,000.  In  April  1999,  Jason  G.  Mewhiney 
was  indicted  by  Canadian  authorities.  In  January  2000,  Mewhiney  pleaded  guilty  to  12  counts  of 
intrusions  which  deluded  violations'  spanning  from  May  1996  through  April  1997,  of 
destroyed/altered  data  and  intrusions  with  foe  intent  to  damage.  In  the  Canadian  Superior  Court 
of  Justice,  Mewhiney  was  sentenced  to  6  months  in  jail  for  each  of  foe  counts  to  run  concurrently. 
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BHssJ  la  February,  1998,  the  FBI  opened  an  investigation  to  assist  the  U.S.  Air  Force  and  IIS. 
Navy  regarding  multiple  computer  intrusions.  The  case  was  worked  jointly  with  the  U.S.  Naval 
Criminal  Investigative  Service  and  Florida  State  Attorney's  Office  in  Jacksonville,  FL.  The 
subject  v'as  identified  as  Jesse  Le  Bliss,  a  student  of  the  University  of  North  Florida.  On  August 
21, 1998,  Bliss  pleaded  guilty  to  one  felony  count  for  vi  olation  of  Florida  State  Statute  815  .06 
entitled,  Offenses  Against  Computer  Users.  On  September  19, 1998,  Bliss  was  sentenced  in  the 
Fourth  Judicial  Circuit,  State  of  Florida,  to  six  months  house  arrest  followed  by  three  years 
probation,  200  hours  of  community  service,  and  a  written  letter  of  apology  to  the  Commandant  of 
the  United  States  Marine  Corps. 

One  pending  case  being  worked  by  the  FBI’s  New  Haven  Division  and  the  U.S. 
Secret  Service  has  been  widely  reported  in  the  press,  due  to  statements  made  to  reporters  by  the 
alleged  perpetrator.  Jh  December  1999,  the  FBI’s  New  Haven.  Division  opened  a  case  into 
intrusions  into  the  computers  of  CD  Universe,  an  on-line  music  seller,  and  the  theft  of  customers’ 
credit  card  numbers  and  a  related  extortion  threat.  Because  of  tire  credit  card  aspect,  the  FBI 
called  the  USSS  to  ask  if  USSS  wanted  to  investigate  jointly.  The  USSS  declined.  In  January 
2000,  the  New  T  ork  Times  ran  a  front  page  story  about  the  case,  based  on  conversations  between 
the  reporter  and  the  alleged  perpetrator.  Subsequently,  USSS  called  the  FBI  back  and  requested 
to  work  the  case  jointly.  That  case  is  still  pending. 

Other 


There  are  other  investigations  that  are  being  conducted  with  other  agencies,  however 
further  details  may  adversely  impact  the  investigation  due  to  their  pending  status.  There  are 
currently  47  pending  investigative  cases  which  are  being  worked  jointly  between  the  FBI  and  the 
multiple  entities  of  the  Department  of  Defense.  An  additional  58  cases  were  investigated  jointly 
with  other  entities  that  are  now  in  closed  status. 

2.  If  some  of  the  referred  cases  are  potential  violations  that  are  traditionally  enforced  and 
investigated  by  other  agencies,  please  describe  your  mechanisms  and  procedures  that  allow 
for  cyber  investigations  to  be  conducted  by  those  particular  law  enforcement  agencies  (other 
than  the  FBI). 

The  primaty  statute  used  by  the  FBI  in  computer  intrusion  investigations  is  Title  18,  USC, 
1 030.  Under  this  statute,  the  FBI  has  broad  authority  to  investigate  computer  crime  offenses.  In* 
instances  where  the  computer  crime  does  not  meet  FBI  jurisdiction,  the  local  FBI  field  office  will 
refer  the  complainant  to  the  appropriate  law  enforcement  agency  (federal,  state,  or  local)  which 
has  authority  to  conduct  the  investigation.  On  other  occasions,  the  FBI  may  continue  to  work  a 
matter  jointly  with  another  law  enforcement  agency,  even  if  they  do  not  have  primary  jurisdiction, 
to  provide  needed  resources  and  technical  expertise.'  FBI  field  offices  develop  liaison  contacts 
with  state  and  local  agencies  investigating  similar  violations  under  state  statutes  and  complaints 
are  disseminated  through  these  liaison  contacts.  The  above  cited  credit  card  case  is  an  example  of 
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how  the  FBI  field  offices  make  direct  contact  with  their  counterpart  field  offices,  such  as  US 
Secret  Service,  to  coordinate  aspects  of  an  investigation. 

3.  Please  specifically  cite  the  number  of  MFC  referred  cases  that  have  a  direct  impact  or 
posed  a  threat  on  file  nation's  critical  infrastructures. 

The  nation’s  “critical  mfrastructures”  are  those  physical  and  cyber-based  systems  essential 
to  the  minimum  operations  of  the  economy  and  government,  including  telecommunications, 
energy^,  banking  and  finance,  transportation,  water  systems  and  emergency  sendees,  both 
governmental  and  private.  One  of  the  most  difficult  aspects  of  cyber  investigations  is  that  it  is  not 
clear  at  the  outset  what  the  extent  of  the  threat,  or  tire  potential  damage  to  networks,  is.  Each  case 
must  be  thoroughly  investigated  to  determine  the  level  of  threat  and  compromise.  What  seems 
like  a  relatively  minor  incident  might  turn  out  to  be  very  significant,  and  vice  versa.  This  means 
that  it  is  much  more  difficult  for  field  investigators  to  use  traditional  investigative  thresholds  in 
determining  how  to  utilize  scarce  resources.  Moreover,  computer  systems  and  networks  employ 
tnpted  relationships  between  other  computer  system  and  networks,  based  upon  the  users' 
privileges.  If  a  computer  system  or  network  is  root-level  (or  super  user)  access  compromi  sed,  the 
threat  potential  is  substantial,  and  could  theoretically  pose  a  major  threat  to  other  trusted  systems. 
This  means  that  “critical  infrastructure”  systems  are  often  connected  with,  and  affected  by, 
systems  that  arc  in  and  of  themselves  not  critical. 

The  existing  NIPC  database  does  not  classify  cases  by  critical  infrastructure  at  this  time. 
Thus,  there  is  no  methodology  to  determine  which  cases  ultimately  involve  a  threat  to  our  nation's 
critical  infrastructure. 


The  Distributed  Denial  of  Service  (DDOS)  attacks  launched  in  February  of  this  year  are  a 
good  example  of  tire  difficulty'  of  cat  egorizing  an  attack  as  an  “infrastructure”  attack  or  some 
lesser  sort  of  attack.  In  a  Distributed  Denial  of  Services  attack,  not  only  are  the  "victim"  systems 
affected,  but  also  the  thousands  of  computer  systems  and  networks  that  were,  unknowingly, 
infiltrated  and  used  to  carry  out  the  attack,  and  Internet  Sendee  Providers  that  were  heavily 
trafficked  during  the  attack.  All  of  the  computer  systems  and  networks  that  participated  in  the 
attack  were  compromised.  Moreover,  even  though  the  effect  of  the  attacks  was  relatively 
ephemeral  and  brief,  the  knowledge  gained  by  analyses  of  these  attacks  is  critical  to  our  abilitv  to 
protect  against  more  devastating  attacks  in  the  future.  If  the  DDOS  attacks  had  been  directed  ' 
against  the  major  Internet  hubs  rather  than  against  primarily  e-commerce  companies,  traffic  on  the 
Interne  t  could  have  been  paralyzed,  disrupting  several  of  the  critical  infrastructures  that  rely  on 
the  Internet  for  communication. 

4.  Please  describe  the  job  description  and  agen  cy  of  any  state  and  local  law  enfo  rcement 
officials  currently  assigned  to  NIPC  on  a  full  time  basis  at  FBI  Headquarters.  - 

The  FBI  currently  has  one  local  law  enforcement  officer  assigned  to  the  NIPC.  He  is  from 
the  Tuscaloosa  County  Sheriffs  Department  and  his  principal  job  is  to  work  on  outreach  initiatives 
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to  state  and  local  law  enforcement  as  part  of  the  FBFs  responsibility  as  the  “Lead  Agency”  to 
work  with  the  ‘‘Emergency  Law  Enforcement  Sendees  Sector”  under  FDD-63.  He  has  also 
participated  in  the  delivery  of  training  to  field  investigators  under  our  Key  Asset  Initiative.  This 
representative  replaced  an  earlier  representative  from  the  Oregon  State  Police,  who  rotated  back  to 
Ms  home  agency.  The  NIPC  is  also  in  discussions  with  several  Washington,  DC.  area  police 
departments  about  having  officers  detailed  to  the  NIPC  on  a  full-  or  part-time  basis. 

5.  Please  describe  any  private  sector  representatives,  past  or  present,  who  voluntarily 
participate  in  the  Center  to  facilitate  sharing  of  information  between  NIPC  and  the  private 
infrastructure  owners  and  operators. 

The  NIPC  works  on  a  daily  basis  with  private  sector  representati  ves  to  share  information. 
This  occurs  through  such  initiatives  as  InfiaGard,  which  provides  information  to  infrastructure 
owners  and  operators  on  a  daily  basis,  and  the  pilot  project  for  Indications  and  Warning  that  the 
NIPC  has  established  with  the  electrical  power  sector  under  the  auspices  of  NERO,  and  the  Key 
Asset  Initiative.  It  also  occurs  on  a  case  by  case  basi  s  as  we  disseminate  targeted  or  general  alerts 
or  warnings  to  industry.  The  NIPC  also  works  closely  with  private  sector  contractors  who  assist 
with  technical  analysis  and  information  sharing. 

In  addition,  the  NIPC  is  working  with  the  Information  Technology  Association  of 
America  to  bring  private  sector  representatives  into  the  Center  for  a  period  of  time  as  “detailees.” 
That  is  part  of  a  cybercrirne  initiative  sponsored  by  the  ITAA  and  the  Attorney  General. 

6.  Please  describe  any  private  sector  representatives  that  are  hired  and  paid  by  NIPC  funds. 

The  NIPC  has  hired  contractors  to  support  our  work  in  analyzing  cyber  intrusions  into  the 
infrastructures  as  well  as  to  provide  technical  support  to  our  investigations.  In  addition,  a 
representative  from  Sandia  National  Laboratories,  has  been  working  at  the  Center.  The  NIPC  has 
been  reimbursing  the  Department  of  Energy  under  the  Interagency  Personnel  Act  for  the  cost  of 
this  detallee’s  contract. 

7.  On  page  lb  of  your  written  testimony,  you  state:  "the  FBI,  on  behalf  of  the  law 
enforcement  community  should  enhance  its  technical  capabilities  (encrypted  evidence)," 
Shouldn't  all  law  enforcement  agencies,  from  federal  to  state  require  this  capability  to 
accomplish  the  NIPC  mission  ? 

■* 

As  noted  on  page  16  of  the  written  testimony,  the  law  enforcement  community  is 
extremely  consumed  about  the  serious  public  safety  threat  posed  by  the  proliferation  and  use  of 
strong,  commrarially-availahle  encryption  products  that  do  not  allow  for  law  enforcement  access 
to  the  plaintext  of  encrypted,  criminally-related  evidence  obtained  through  court-authorized 
electronic  surveillance  and/or  search  and  seizure.  The  potential  use  of  such  non-xeeoverable 
encryption  products  by  a  vast  array  of  criminals  and  terrorists  to  conceal  their  criminally-related 
communications  and/or  electronically  stored  mformation  poses  an  extremely  serious  threat  to 
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public  safety  and  national  security. 

In  order  to  address  this  serious  threat  and  as  noted  in  the  written  testimony,  it  is  imperative 
that  law  enforcement  enhance  it  technical  capabilities  in  the  area  of  plaintext  access  to  encrypted 
evidence.  As  part  of  the  government’s  approach  to  the  encryption  issue,  the  Administration  has 
expressed  support  for  and  has  proposed  the  creation  of  a  law  enforcement  Technical  Support 
Center  within  foe  FBI  for  the  purpose  of  providing  foe  entire  law  enforcement  community  with 
urgently  needed  plaintext  access  technical  capabilities  necessary  to  fulfill  its  investigative 
responsibilities  in  light  of  the  proliferation  of  strong,  commercially-available  encryption  products 
within  foe  U.S,  In  fact,  included  in  fee  Administration's  Cyberspace  Electronic  Security  Act  of 
1 999  which  was  forwarded  to  foe  Congress  last  September  is  a  provision  that  authorizes- to  be 
appropriated  $80  million  to  foe  FBI  for  foe  creation  of  foe  Technical  Support  Center,  whi  ch  will 
serve  as  a  centralized  technical  resource  for  federal,  state  and  local  law  enforcement  in  responding 
to  the  ever  increasing  use  of  encryption  by  subjects  of  criminal  cases. 

The  TSC  is  envisioned  as  an  expansion  of  the  FBI’s  Engineering  Research  Facility  (ERF) 
to  take  advantage  of  ERF's  existing  institutional  and  technical  expertise  in  this  area.  This 
approach  represents  -a -cost  effective,  non-duplicative  and  efficient  means  of  provide  every  U.S. 
law  enforcement  agency  with  access  to  technical  capabilities  needed  to  address  lawfully  seized 
encrypted  evidence  and  is  supported  by  the  International  Association  of  Chiefs  of  Police,  the 
National  Sheriffs  Association  and  the  National  District  Attorney  Association  as  well  as  the 
Information  technology  industry'. 


8.  Please  describe  which  agencies  were  in  the  past  participating  in  the  NIPC,  but  are  no 
longer  members.  Describe  the  reasons  given  by  those  agencies  to  the  FBI  for  their 
withdrawal  from  participation. 


One  of  the  difficulties  in  attempting  to  operate  an  interagency  Center  is  ensuring  that  all 
relevant  agencies  participate.  Agencies  have  not  received  direct  funding  to  participate  in  foe 
Center,  and  so  must  take  defailees  to  foe  NIPC  out  of  existing  personnel  resources.  In  addition, 
personnel  with  cyber  expertise  are  unfortunately  in  very'  short  supply,  meaning  that  agencies  must 
commit  to  take  scarce  resources  and  send  them  outside  their  agencies.  Despite  these 
impediments,  numerous  agencies  have  sent  detailees  to  the  NIPC,  Including:  Defense/Office  of 
..  foe  Secretary  of  Defense;  Central  Intelligence  Agency,  National  Security  Agency;  Air  Force 
Office  of  Special  Investigations;  U.S.  Navy;  U.S.  Army;  U.S.  Postal  Service;  Defense  Criminal 
Investigative  Service;  General  Services  Administration;  U.S,  Air  Intelligence  Agency; 
Department  of  Commerce,  and  foe  Tuscaloosa,  AL  Sheriffs  office.  In  addition,  we  have  foreign 
fiaison  representatives  from  two  allied  countries  who  assist  in  coordinating  international  activities 
wifo  our  cotmtetparts.  A  representative  torn  FAA  is  also  scheduled  to  start  at  foe  end  of  June. 
Additional  repressmtefive  from  DoD,  CIA,  and  NSA  are  also  slated  to  arrive  in  foe  near  future. 

We  are  also  expecting  representatives  from  local  Washington  area  police  departments  on  a  part- 
time  basis. 
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Some  agencies  were  represented  earlier  but  do  not  currently  have  representatives. 
Circumstances  necessitated  the  recall  of  the  first  State  Department  representative.  State  agreed  to 
do  so,  and  has  committed  to  NIPC  that  it  would  replace  him  with  two  new'  representatives,  DoE’s 
first  representative  rotated  hack  after  more  than  two  years.  NIPC’s  understanding  as  to  whv  this 
representative  rotated  bade  is  that  he  was  at  NIPC  for  a  lengthy  time  and  was  needed  at  DoE 
headquarters  to  assist  m  a  DOE  reorganization.  DoE  has  committed  to  replacing  that  detailee. 

Secret  Service  earlier  had  two  detailees  to  the  NIPC,  but  recalled  those  detailees  and  has 
not  yet  committed  to  replacing  them.  Secret  Service  has  not  provided  any  written  explanation  for 
tins,  but  in  oral  discussions,  Secret  Service  officials  stated  that  USSS  was  not  getting  additional 
funding  for  its  electronic  crimes  program  despite  its  participation  in  NIPC;  the  FBI  was  receiving 
more  media  attention  in  the  cyber  crime  area;  and  NIPC  had  not  “referred”  cases  to  Secret  Service 
for  investigation.  NIPC  offered  any  support  it  could  give  to  Secret  Service  in  addressing  budget 
requests;  noted  that  NIPC  public  statements  often  referred  to  partnership  with  USSS*  and  offered 
to  do  more-  to  support  USSS  initiatives  with  public  statements  and  case  analyses.  NIPC  also 
stated  (as  discussed  further  below)  that  its  role  is  not  to  create  and  “refer"  cases*  rather  eases 
generally  originate  in  Field  Offices,  and  FBI  and  Secret  Service  field  offices  frequently  work 
computer  crime  cases  together. 

NIPC  fully  recognizes  the  value  other  agencies  bring  to  the  cyber  crime  and  infrastructure 
protection  mission.  That  is  why  NIPC  is  an  interagency  Center,  and  has  senior  managers  from 
other  agencies  in  addition  to  investigators  and  analysts.  For  instance,  the  NIPC  Deputy  Director 
is  from  DoD/OSD;  the  Section  Chief  of  the  Analysis  and  Warning  Section  Is  from  CIA;  the 
Assistant  Secti  on  Chief  of  the  Computer  Investigations  and  Operations  S  ection  is  from  Air  Force 
OSI;  the  Unit  Chief  of  the  Analysis  and  Information  Sharing  Unit  is  from  NS  A;  and  the  Unit 
Chief  of  the  Watch  and  Warning  Unit  is  from  the  U.S.  Navy.  Secret  Sendee  formally  occupied 
the  position  of  Assistant  Section  Chief  of  the  Training,  Outreach,  and  Strategy  Section, 

Recognition  of  the  need  for  other  agency  participation  is  also  what  drives  NIPC  to  continually 
seek  additional  representatives  from  offer  agencies.  It  Is  also  reflected  in  the  numerous  joint 
investigations  ff  at  NIPC  and  FBI  Field  Offices  have  been  involved  in  with  off  er  agencies  (as 
discussed  further  below'),  v 


Senator  Leahv: 

1.  Can  an  attempt  to  commit  a  violation  of  18  U.S.C.  §  1030  (a)(5)  currently  be  prosecuted 
under  the  attempt  provision  found  In  18  U.S.  C.  §  1030(b),  even  if  the  attempt  does  not 
result  in  loss  of  at  least  $5,000  or  cause  one  of  the  other  results  listed  in  §  1030  (e)(8)? 

_  ’^ie  question  calls  for  an  answer  interpreting  prosecution  authority  under  statute,  and  as 
such,  is  more  appropriately  propounded  to  the  Department  of  Justice.  As  a  general  rale,  however 
the  FBI  understands  that,  under  certain  factual  circumstances,  18  U.S.C.  §  1030(b)  does  allow  for 
the  prosecution  of  violations  of  18  U.S.C.  §  1030(a)(5)  even  if  the  attempt  does  not  result  in  a  loss 
of  at  least  $5,000  where  evidence  demonstrates  the  offender  ’s  specific  intent  was  to  cause  a  loss 
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In  excess  of  $5,000. 

2.  If  an  attempt  cannot  be  so  prosecuted,  would  amending  the  statute  so  that  the 
aggravating  factors  included  in  the  definition  of  "damage"  in  18  U.S.C.  SS  1030  (eltSVAV. 

<D)  are  instead  moved  to  be  elements  of  the  offense  under  §  1030  (a)(5)  change  thatSt? 

T&z  question  calls  for  a  hypothetical  interpretation  of  a  statutory  amendment  as 
appKed  through  fee  substantive  case  law  of  "attempt,"  and  should  be  directed  to  the  Department  of 
Justice  for  a  more  detailed  and  definitive  response.  As  a  general  matter,  however,  the  FBI  does 
not  understand  that  elevating  the  definitional  elements  of  the  term  "damage"  to  become 
substantive  elements  of  section  1030  offenses  will,  in  all  circumstances,  resolve  the  attempted 
©tee  issues  generated  by  the  facts  of  most  investigations.  Instead,  the  FBI  favors  an  approach 
which  would  combine  a  restructuring  of  the  elements  of  the  definition  of  "damage"  into  the 
penalty  provisions  of  section  1030(c)  with  the  creation  of  a  lesser  offense  for  those  circumstances 
where  damages  of  $5,000  or  more  cannot  he  substantiated  The  FBI  believes  that  some 
unauthorized  access  intrusions  into  computers  affecting  interstate  commerce  (Le.,  protected 
computers)  are  so  inherently  violative  as  to  justify  Federal  criminal  sanctions  even  where  there  is 
no  change  affecting  the  integrity  or  availability  of  data  or  where  the  actual  damages  suffered  do 
not  attain  tire  $5,000  threshold.  The  intentional  unauthorized  computer  intrusion  into  the 
privileged  and  private  medical  records  of  citizens  is  but  one  such  example.  Such  a  statutory 
approach  as  has  been  suggested  by  DoFs  Computer  Crime  and  Intellectual  Property  Section 
(COPS)  would  create  a  lesser  included  misdemeanor  offense  where  the  $5,000  threshold  is  not, 
in  fact,  demonstrated  and  would  provide  jurors  in  cases  involving  damages  close  to  the  threshold 
a  legitimate  alternative  for  otherwise  violative  behavior. 

3.  If  a  definition  of  "loss"  were  added  to  §  1030(e)  to  define  loss  as  "the  reasonable  cost  to 

any  victim  of  responding  to  the  offense,  conducting  a  damage  assessment,  restoring  data, 
programs,  systems  or  information  to  their  condition  prior  to  the  offense  and  any  revenue 
lost  or  costs  incurred  by  the  victim  as  a  result  of  interruption  of  sendee,"  would  the  $5,000 
threshold  be  easier  to  meet  than  under  current  law?  '  *  * 

The  FBI  favors  any  amendments  which  allow  for  the  increased  inclusion  of  any  costs, 
losses  or  other' expenditures  that  a  victim  would  not  have  reasonably  incurred  but  for  the  violation 
regardless  of  whether  those  losses  resulted  from  an  actual  interruption  of  sendee.  The  FBI  favors 
such  a  definition  which  would  also  include,  if  reasonable,  the  cost  of  system  reconfigurati  on 
related  to  deterring  or  eliminating  similar  future  violations. 

4.  With  respect  to  violations  of  §  1030(a)(5)(A),  is  it  your  understanding  that  each  separate 
"transmission"  could  form  the  basis  of  a  separate  count?  Similarly,  with  respect  to 
violations  of  §§  1030(a)(5)(BHQ»  is  it  your  understanding  that  each  separate  "intentional 
access!  1  ”  could  form  the  basis  of  a  separate  count? 

The  question  calls  for  an  interpretation  of  a  statute  applying  the  substantive  case  law  of 
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what  constitutes  "criminal  episode,"  and  related  concepts  of  what  constitutes  appropriate 
joinder,"  or  "severance"  under  the  Federal  Rules  of  Criminal  Procedure  and  should  more 
appropriately  be  directed  to  the  Department  of  Justice  for  a  detailed  and  definitive  response  As  a 
general  matter,  however,  the  FBI  understands  that  whether  a  single  computer  transmission  of 
malicious  code  under  section  1030(a)(5)  may  form  the  basis  for  a  single  count  under  an 
indictment  will,  m  large  measure,  turn  upon  the  unique  facts  of  any  given  investigation.  Whether 
a  single  transmission  of  a  self-replicating,  self  transmitting  destructive  computer  virus  constitutes 
one  transmission,  and  therefore  one  count,  or  thousands  of  transmissions  intentionally  effectuated 
by  chain  reaction,  and  therefore  thousands  of  counts,  may  turn  upon  an  evaluation  of  numerous 
factors  not  the  least  of  which  would  include  the  object  and  intent  of  the  offender/transmitter,  the 
deap  of  the  code,  the  reasonable  foreseeability  of  re-transmission  and,  as  a  practical  matter  the 
abihty  to  track,  gauge  and  prove  the  re-transmission.  Similarly,  whether,  in  a  computer  network 
thC  repefed  ^^onzed  accessing  of  a  computer  in  violation  of  section 
(a)(5)(B)*(C),  which  accessing  is  temporally  related,  will,  as  a  practical  matter,  frequently 

turn  upon  the  configuration  of  the  network  and  its  security  and  banner  system,  to  name  but  a  few 
factors. 


5.  Are  you  aware  of  any  cases  in  which  the  current  statutory'  maximum  terms  of 

imprisonment  under  18  U.S.C.  §  1030  were  insufficient  to  effect  the  sentence  called  for  bv 
the  Sentencing  Guidelines,  including  using  the  provisions  of  U.S.S.G.  §  5G1 ,2,  which  ' 

provide  that  sentences  on  multiple  counts  may  be  imposed  consecutively'  to  the  extent 

necessary'  to  produce  a  combined  sentence  equal  to  the  total  punishment  called  for  by  the 
guidelines? 

The  NIPC  referred  this  question  to  the  Department  of  Justice  Computer  Crimes  and 
a?  !???31  Pr0perty  Section  for.  inPut  1116  Department  reported  that  it  could  recall  no  cases  in 

which  the  current  statutory  maximum  terms  of  imprisonment  under  18  U.S.C.  §  1030  were 

insufficient  to  effect  the  sentence  called  for  by  the  Sentencing  Guidelines,  including  using  the 
provisions  of  U.S.S.G.  §  5GL2.  s 

6.  Please  explain  the  reason,  if  any,  to  continue  the  codification  of  the  work-sharing 
~  between  the  Secret  Se™«  t&e  Federal  Bureau  of  Investigation  found  in  § 

,  ,?.!?!*  spedficaUy  ^  &e  Secret  Service’s  authority  to  investigate  crimes 

i  °  i° tbose  ofFenses  mdtT  subsections  (a)(2)(A)  and  (B),  (a)(3),  (a)(4),  (a)(5) 
and  (a)(6).  The  Senate  Report  accompanying  the  1 996  amendment  explained  that: 

[fjhe  new  crimes  proposed  in  the  bill,  however,  do  not  fall  under  the  Secret 
Service's  traditional  jurisdiction.  Specifically,  proposed  subsection  1030fa¥2VCt 
addresses  gaps  in  18  U.S  .C.  2314  (interstate  traLportation  of  stolen  pmpSy)S 
proposed  section  1030(a)(7)  addresses  gaps  in  18  US.C.  1951  (the  Hobbs  Act)  and 
875  (interstate  threats).  These  statutes  are  within  the  jurisdiction  of  the  Federal 
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Bureau  of  Investigation,  which  should  retain  exclusive  jurisdiction  over  these  types 

of  offenses,  even  when  they  are  committed  by  computer. 

S.  Rep.  No.  357, 104th  Cong.,  2d  Sess.  13  (1996). 

Inherent  in  die  1996  changes  was  the  recognition  that  the  statute  was  being  amended  to 
reflec  t  the  respective  investigative  jurisdictional  limits  existing  at  that  time.  It  was  clear  at  that 
time  that  the  jurisdiction  of  the  Secret  Service,  found  at  18  U.S.C  §  3056,  did  not  encompass  the 
types  of  offenses  described  m  Section  1030  (a)(1),  (a)(2)(C),  or  (a)(7).1  Given  that  there  have 
been  no  additional  grants  of  general  investigative  jurisdiction  to  the  USSS  since  that  amendment, 
it  is  not  clear  why  the  USSS’s  jurisdiction  over  computer  crimes  under  Section  1 030  should  be 
expanded.  The  theft  of  National  Security  information  which  is  the  type  of  information  Section 
1030(a)(1)  was  intended  to  address  has  never  been  the  subj  ect  of  US  SS  jurisdiction.  In  addition 
the  types  of  crimes  contemplated  by  1030(a)(2)(C)  and  (a)(7),  as  recognized  by  the  legisl  ati  ve 
history,  have  traditionally  been  investigations  solely  in  the  province  and  expertise  of  the  FBI. 

The  1996  provision  is  an  explicit  effort  by  Congress  to  address  the  criminal  offenses  at 
issue  through  a  division  of  labor  primarily  determined  by  investigative  responsibility  and 
expertise.  Any  reversion  to  the  pre-1 996 jurisdictional  provisions  raises  serious  issues  and 
concerns  about  the  utilization  of  resources  and  proper  coordination.  Concurrent  jurisdiction 
would  result  in  a  duplication  of  efforts  that  would  waste  resources  and  encourage  independent 
investigations  by  separate  agencies  at  the  expense  of  coordinated  joint  efforts.  Indeed,  given  the 
decision  by  Secret  Service  to  refrain  from  participation  in  the  National  Infrastructure  Protection 
Center  (MPC)  (both  by  detailing  personnel  and  providing  investigative  information  from  its 
cases)  despite  a  mandate  from  the  President  to  do  so  under  PDD-63,  expanding  USSS’s  cyber 
jurisdiction  at  tins  time  would  result  in  a  fractured  approach  to  sensitive  intrusion  investigations 
involving  espionage,  extortion,  and  other  serious  matters.  . . 

7.  The  FBI  has  limited  authority  to  issue  administrative  subpoenas  in  certain  cases,  such  as 
federal  health  care  fraud  or  sexual  exploitation  or  other  abuse  of  children.  Since 
cj  bercrime  cases  are  criminal  in  nature,  is  the  FBI  able  to  obtain  documents  relevant  to  the 
investigation  with  grand  jury  subpoena?  To  the  extent  that  documents  obtained  with  a  > 


-1  ’Under  the  direction  of  the  Secretary  of  fee  Treasury,  the  Secret  Service  is  authorized  to  detect  and 
wk>  violates-* 


arrest  any  parson 


P  .  , .  (^i<5a  f*°>S71,t>r  879  *rthis  rifle  or,  with  respect  to  the  Federal  Deposit  Insurance  Corporation, 

--  ^tattons.secrionZn.Zie. 433, 493. 657, 709, 1006, 1007.  lOti,  1013, 1014, 

(2)  *ny  of  few*  of  the  United  States  relating  to  coirt$>  obligations,  and  securities  of  United  Km  d  ff  * 

••  •;  .v  .  ,  aies  aacf  ei  toraga 

. .  £>  "*?  0^c  Uw*  ?fthf  Unitcd  Sm«  electronic  fund  transfer  feuds,  credit  and  debit  card  feuds,  and 

thetiwth&tity  conferred  by  this  paragraph  shall  be  exercised  «ib,4  fe  he 

enforcement  agency  with  respect  to  those  laws.  °  - 0  anyo  er  eraltaw 


5/24/02  Release 


-Page  4< 


grand  Jury  subpoena  need  to  be  shared  with  third-party  experts,  can  permission  be 
obtained  to  do  so  under  Federal  Rule  of  Criminal  Procedure  6(e)(3)? 

Generally  speaking,  a  '’governmental  entity"  is  authorized  under  18  U.S.C.  2703  (b)  (1) 
(B)  to  obtain  the  contents  of  an  electronic  communi  cation  in  rewrote  computer  storage  with  prior 
notice,  as  delimited  in  18  U.S.C.  2703(b)  (2),  by  using  an  administrative  or  grand  jury  subpoena. 
A  governmental  entity  is  also  authorized  under  18  U.S.C  2703(c)(1)(C)  to  obtain  certain 
subscriber  or  customer  information  horn  a  provider  of  electronic  communication  services  or 
remote  computing  service,  by  using  an  administrative,  grand  jury,  or  trial  subpoena,  or  as 
otherwise  permitted  under  IS  U.S.C.  2703  (c)(1)(B),  The  Electronic  Communications  Privacy 
Act  (ECPA)  does  not  itself  identify  which  federal  agencies  qualify  as  "government  entities" 
authorized  to  issue  administrative  subpoenas.  Currently,  the  FBI  is  authorized  to  issue 
administrative  subpoenas  in  cases  involvinghealth  care  fraud  under  18  U.S.C.  §3486  and  in  cases 
involving  child  pornography  and  sexual  solicitation  under  18  U.S.C.  §3486A.  Unfortunately, 
there  does  not  currently  exist  a  statute  authorizing  or  designating  the  FBI  as  a  "governmental  * 
entity"  authorized  to  issue  administrative  subpoenas  for  violations  of  18  U.S.C.  §  1030  or  other 
crimes  of  fraud  increasingly  committed  by  or  facilitated  through  the  use  of  a  computer.  The 
absence  of  such  a  statute  impedes  FBI  efforts  to  accelerate  an  effective  response  to  cyber  crime. 

While  helpful,  the  use  of  grand  jury  subpoena  to  acquire  minimally  intrusive  transactional 
information  (e.g.,  so-called  "header  information”  such  as  "to"  or  "from")  or  subscriber  information 
(e.g„  the  name  and  address  of  the  owner  of  an  Internet  screen  name)  is  frequently  a  cumbersome 
and  time  consuming  process  especially  in  investigations  where  time  is  of  the  essence  or  where  the 
information  sought  is  from  an  unusually  large  number  o  f  provid  ers.  Some  circumstances  may 
dictate  seeking  express  court  authorization  under  the  provisions  of  Federal  Rule  of  Criminal  * 
Procedure  6(e)(3)(C)  for  disclosure  to  non-government  experts  who  may  not  qualify  as  personnel 
assisting  the  attorney  for  the  government  in  die  investigation  before  the  grand  jury.  In  many 
cases,  the  practical  concerns  of  delay  and  coordination  with  other  agencies  and  courts  further 
stymies  government’ s  ability  to  provide  a  timely  response  to  imminent  criminal  behavior. 

The  FBI  supports  an  expansion  of  its  statutory  authority  to  issue  administrative  subpoena 
under  the  Electronic  Communications  Privacy.  Act  for  any  violation  of  law  within  die  FBI’s 
existing  criminal  investigative  jurisdiction.  The  FBI’s  experience  to  date  in  the  issuance  of 
administrative  subpoena  in  the  areas  of  health  care  fraud  and  child  exploitation  crimes 
demonstrates  that  it  can  responsibly  limit  and  control  the  exercise  of  this  authority. 

8.  Denial  of  service  attacks  are  increasing  exponentially.  According  to  the  FBI,  these  attacks 
involve  the  placement  of  tools  such  f  asj  Trinoo,  Tribal  Blood  net,  TFN2K  or  Stechenldraht 
on  unwitting  victim  systems,  which  then  send  messages  upon  remote  command  to  a  targeted 
computer  system  until  that  system  Is  overwhelmed  and  essentially  shntfs]  down.  In  order  to 
document  in  real-time  the  remote  command  being  given  and  the  triggering  of  the  message 
flood  to  the  target  system,  is  law  enforcement  currently  required  to  obtain  a  wiretap  order 
since  the  unwitting  victim  system  is  not  a  "party  to  the  cornmnnicatron’*  authorized  to  grant 
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consent  to  electronic  surveillance?  Would  an  exception  to  the  wiretap  law  to  allow  the 
unwitting  victim  system  operator  to  grant  consent  to  electronic  surveillance  be  helpful  to 
law  enforcement? 

Hie  question  calls  for  an  interpretation  of  a  statute  which  would  more 
appropriately  be  directed  to  the  Department  of  Justice  for  a  more  detailed  and  definitive  response. 

As  a  genera!  matter,  however,  the  FBI  understands  that;  1)  the  provisions  of  18  U.S.C. 

§251  l(l)(a)  prohibit  all  interceptions  unless  expressly  authorized  elsewhere  in  the  Act;  2)  the 
provisions  of  18  U.S.C.  §251  l(2){a)(i)  authorize  a  provider  of  wire  or  electronic  communication 
sendees  to  intercept  communications  on  their  system,  not  because  they  are  parties  to  those 
communications,  but  as  "is  a  necessary  incident  to  the  rendition  of  [that]  service  or  to  the 
protection  of  the  rights  or  property  of  the  provider,,,.;"  3)  many  providers  {especially  start-up 
Internet  services)  may  not  have  the  necessary  tools  or  expertise  to  adequately  track,  document  or 
halt  an  intruder  in  their  system  and,  more  perhaps  more  significantly,  no  providers  have 
compulsory  process  to  facilitate  disclosure  of  transaction  and  subscriber  information  from  other 
providers  which  is  necessary  to  identify  the  source  of  an  attack;  4)  18  U.S.C,  §251  l(2)(a)(i)  does 
not  permit  law  enforcement  to  conduct  an  interception  {without  a  court  order)  even  upon  a 
provider  s  express  request  when  the  provider’s  system  has  been  invaded  or  trespassed  upon  by  a 
hacker,  and  5}  as  a  result  of  this  quandary,  and  in  order  to  ensure  that  evidence  obtained  will 
subsequently  be  held  admissible,  law  enforcement  is  required  to  obtain  a  court  order  m  order  to 
enable  it  to  actively  work  in  conjunction  with  the  provider. 

Given  the  high  level  DOJ  approval  that  is  required  for  Title  in  Interception  applications,  the 
necessary’'  generation  of  paperwork,  and  the  time  needed  by  the  reviewing  court,  significant  delay  can 
occur  before  law  enforcement  can  provide  an  effective  response  to  a  hacker  or  DDOS  event.  This 
anomaly  in  the  law  creates  an  untenable  situation  whereby  providers  are  sometimes  forced  to  sit  idly 
by  as  they  witness  hackers  enter  and,  in  some  situations,  destroy  or  damage  their  systems  and 
networks  while  law  enforcement  begins  the  de  tailed  process  of  seeking  court  authorization  to  assist 
them.  In  the  real  world,  the  situation  is  akin  to  a  homeowner  being  forced  to  helplessly  watch  a 
burglar  or  vandal  while  police  seek  a  search  warrant  to  enter  the  dwelling.  For  these  reasons,  the  FBI 
favors  enactment  of  a  statutory  exception  under  18  U.S.C.  §251 1  which  w’ould  expressly  authorize 
law  enforcement  to  assist  such  provi  ders  by  intercepting  the  communications  of  a  compu  ter 
user/trespasser  (the  transmissions  to  and  from  the  tiser/trespasser)  BUT  ONLY  upon  the  voluntary, 
written  consent  of  a  service  provider  after  that  provider  has  made  an  initial  determination  that  the  ' 
nser/trespasser  is*  “  fact,  not  authorized  to  be  on  the  system  or  network.  Such  an  exception  to  the 
general  interception  prohibition  would  accelerate  exponentially  law  enforcement’s  ability  to  respond 
to  such  hbeker  incidents  and  would  be  a  significant  step  toward  ensuring  the  security  and  integrity  of 
the  Nation’s  critical  infrastructure.  v-: 


/.  Is  law  enforcement  currently  required  to  obtain  a  wiretap  in  order  to  document  in  real¬ 
time  the  remote  commands  being  given  to  a  target  system? 
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potential  exception  to  this  would  be  certain  pen  register-based  approaches  employed  by  sendee 
providers  in  switch-based  solutions,  where  post-cut-through  dialing  (including  post-cut-  through 
signaling)  may  not  be  provided  to  law  enforcement;  This  circumstance  is  currently  a  subject  of 
review  by  the  FCC  under  rule  making  implementing  CALEA,  and  regarding  which  we  anticipate  a 
resolution  in  fee  near  future.)  The  distinction  between  a  pen  register  device  on  a  telephony  service 
and  a  clone  pager  (or  pager  interception)  is  that  a  pen  register  is  employed  to  capture  dialed  numbers 
which  are  used  to  set  up  a  call.  Hence,  in  the  overwhelming  majority  of  instances  where  pen  registers 
are  used  fee  information  captured  is  simply  signaling  information  used  to  set  up  a  call.  By 
comparison,  pager  interceptions  are  employed  to  capture  fee  information  received  by  a  pager  which, 
in  all  instances,  constitute  fee  content  or  message  of  the  call  Consequently,  the  law  has  historically 
distinguished  fee  legal  processes  required  for  these  two  types  of  acquisitions  (i.e.,  pen  register 
authority  vs  Title  HI  authority,  respectively). 

Pen  register  efforts  in  fee  data  network  area  work  somewhat  differently.  The  most  basic 
reason  for  tins  is  because  fee  services  (e.g,,  email,  web-based  mail,  voice  over  IP)  and  applications 
(e.g,,  Internet  Chat,  File  Transfer)  transmitted  over  data  networks  are  somewhat  different.  Some  of 
these  services  and  applications  lend  themselves  to  precise  ways  of  capturing  (Le»,  recording)  call 
identifying  and  signaling  information  only  while  others  make  the  process  of  differentiating  signaling 
information  from  call  content  more  difficult  "  ~ 

9(B)  Section  3121(c)  of  title  18,  United  States  Code,  requires  government  agencies 
authorized  to  use  pen  registers  to  "use  technology  reasonably  available...that  restricts  the 
recording  or  decoding  of  electronic  or  other  impulses  to  fee  dialing  and  signaling  information 
utilized  in  call  processing.”  Please  describe  the  technolog}'  and  methodology  currentlv 

employed  to  comply  wife  this  statutory  requirement 

Pen  Register  devices  on  telephony  services  continue  to  operate  as  they  have  for  decades 
Stated  differently,  since  the  enactment  of  CALEA  there  has  been  no  change  in  technology  or  pen 
register  equipment  for  telephony  that  would  better  restrict  the  recording  or  decoding  of  electronic  or 
other  impulses  to  the  dialing  and  signaling  information  utilized  in  call  processing. 

As  stated  above,  pen  register  efforts  in  the  data  network  area  work  somewhat  differently,  and 
there,  where  technology  that  restricts  the  recording  or  decoding  of  electronic  or  other  impulses  to  tire 
dialing  and  signaling  information  is  reasonably  available,  it  is  employed.  For  example,  fee  FBI 
employs  pen  register  devices  to  capture  Internet  Protocol  (IP)  addresses.  Since  data  networks 
typically  use  well-established  layered  protocols,  FBI  tools  are  capable  of  restricting  fee  Information 
captured  to  fee  IP  address. 


10.  Section  3121(a)  of  title  18,  United  Sta  tes  Code,  requires  a  court  to  authorize  the  u  se  of  a 
pen  register  If  the  court  finds  feat  the  government  attorney  has  certified  feat  fee  information 
likely  to  be  obtained  by  "such  use  Is  relevant  to  an  ongoing  criminal  investigation.”  The 
certification  by  fee  government  attorney  is,  in  fern,  made  under  oath  and  penalty  of  perjury. 
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under  section  3122. 


ItllV'T:—  a,',0r"'!’  rc9“ired  <»  describe  to  the  coorl  in  the  application  for  a  pen 
criminal  inv^tioK'' ?  a“°rn'5”S  “rt“I“'io"  **  ««  “  "l«vant  to  an  ongoing 

08)  As  a  matter  of  regular  practice,  do  government  attorneys  or  State  law  enforcement  or 
ofJ”*rs  application  for  pen  registers  describe  for  the  court  the  factual 

doel  this  practice  vary?**  *  iS  *°  aa  °n§oing  crim{na!  investigation’*  or 

(C)  What  procedures,  including  audits  or  internal  reviews,  are  in  place  to  ensure  that 
government  attorney  and  State  law  enforcement  or  Investigative  officers  comply  with  the 

L  ,  ,a“d  If  ' <b'  B'“ssar>'  h™s  for  “W»*  ««  application,  particularly 

“  *b< “  ‘f™*?  f1'"  Pta'fce  In  applying  for  pen  register  orders  is  not  to  describe  for  the 
court  the  factual  basis  for  certification? 

p)  Should  tfapcourt,  rather  than  governmental  attorneys  or  State  law  enforcement  or 

“  oS*faId?CerB*fc  *  glV!f iht  mihoTity  t0  make  the  factual  finding  that  “information  likely 
to  be  obtained  by  such  installation  and  use  [of  a  pen  register]  Is  relevant  to  an  ongoing  criminal 
investigation,"  and  if  not,  please  explain  why?  h  8 

Several  of  the  questions  call  for  or  implicate  an  interpretation  of  statute  which  would  more 
appropriately  be  directed  to  the  Department  of  Justice  for  a  more  detailed  and  definitive  response  As 
a  general  matter,  however,  the  FBI  understands  the  .Supreme  Court  has  expressly  ruled  that  "the 

o  a  pen  register  [is]  not  a  ''search"  within  tire  meaning  of  the  Fourth  Amendment  and 
therefore  its  use  does  not  violate  the.  Constitution."  .Smith  v.  Man-land.  442  US  735  74 M6  99 

content*/ f* 2  8h°979)‘  ^  °f "  stake  in  theM^f 

SS  Jnfoimahon  garnered  through  the  use  of  p  en  registers,  the  Courts  ha  ve  held  that  the  l  imited 

judicial  review  ro k >  delineated  by  18  US.C  §3121  etseq.  is  Constitutional  and  is  intended  to 

eguar  against  the  purely  random  use  of  pen  register  devices  by  ensuring  compliance  with  the 

AOZilSh^mO)5  CSt2bhShed  b>' Congre£S-  See  United  Sia(es  *  Hallmark,  91 1  F.2d  399, 401- 

~  a  st®“  certifIcations  tby  government  attorneys  are  drafted  and  filed  by  attorney's  of  the 

Department  of  Justice  and  not,  at  the  Federal  level,  by  Special  Agents  of  the  FBI,  Questions 

SS ccrtiflcf om  wo“ld  mm  wropriately  directed  to  the  Department  of 
ft.  *1*.  towever,  it  is  toe  FBI’s  experience  tost 


A  ~  '  .  *  ;  ~  w  me  naiure  ox  me  stamtory  offense  which  i 

&e  focus  of  the  investigation u  Whereas  section  3123(b)(1)(D)  requires  that  all  pen  register  orders 

°ffefeto  wMch  the  information  likely  to  be  obtained  by  the  pen  register 
trap  an  ce  device  relates,"  it  follows  that  the  application  required  by  section  3 122(b)(2)  contain 
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5  and  it  is  the  FBI’s  experience  that  this  is 

commonly  te  case.  Depending  upon  the  nature  ofthe  offense  described  in  the  certificaion  the 
underljang  basts  for  the  certification  can,  and  in  most  instances  will  be  readily  aXeTSfl 

« 51? 5  ^ “f  U’e  obvio’K  ia  that  the  ofj-JL  are  £ 

?«  a  50  S‘mi,ariy  in  nro0,iK  md  to  commit  narcoUcTtSnTihe 

reliable  and  common  sense  inference  is  dearly  that  telecommunications  are  hd™  f  /U?  ’ th 

of  7®>W  aubsnmces  in  violation  of  Tide  21  of  L  5 

and  Abuse  Act  (18  U.S.C.  SlIoSOs^rjufrSKfcuf^hT  ™M°n  °f  th'  Computer  Fraud 
underlying  basis  for  the  request,  *  ^  ^  °r  m,a®nal“  to  m^astand  the 

.  .  r  '  *5  *5°  7mlands.ttol  Ae  so1e  >>»*  for  obtaining  a  pen  register  order  is  to  father  a 
comma]  investigation  by  generating  reliable  admissible  evidence.  An  attorney  who  fabSv  m 

"T" n°  18 U'SC  §3122®®  d« a^his/her 
pent  subject  to  sanction,  disbarment  and  prosecution.  Furthermore,  an  attorney  who  so  falselv 

certifies  such  an  application  has  no  way  of  knowing  the  subsequent  coume  and  outcome  oS 

imcs  gabion  Frequently,  information  received  from  a  pen  register  is  consolidated  with  other 

iS  SUbmlfted  in  SUbs^eat* **  W  appHcatbns  M?Court  such 
as  search  warrant  applications  or  wiretap  applications.  In  the  unlikely  event  that  an  attorney  for  th* 
government  were  to  submit  a  false  certification  to  the  court  in  c„mi  ne  ?  K°  ey  f  r  the 

the  lack  of  any  nexus  between  the  named  subjects  ofthe  investiouf  tt  8  fen  reSlster  application, 

J  th,.  ,Hnra '  „„w-r  *.  !  ««nwi  BUDjects  01  the  investigation,  the  ‘'statement  of  the  offense  " 

he  attorney  s  certification  that  the  information  likely  to  be  obtained  from  the  devise’s  use  is  * 

reel  ant  to  an  ongoing  criminal  investigation  would,  in  many  instances  reveal  itself  either  in 

sr£STh!:;f  s*-  “  wras 

prosecution.  I  ho  dearth  of  such  empirical  or  anecdotal  evident  J 

certification  of applicaions  by  attorney,  for 

obligation  is  conscientiously  fulfilled.  certification 

caused  thTml?JeStlfier  tha{.i^ormation  theft  a*d  financial  fraud  perpetrated  online  have 
caused  the  most  severe  financial  losses,  "put  at  $68  million  and  $56  million  respectively  «  t„ 

■*»*  ? r  fra"<""™'  1,1 

Tf'1  ““j1™8"  r*“°£ ,he  1,1  Md  law  enforcement  in  general.:  Appreciating  this 

Tt.  W C0”grBS  bt  rareM  ta  legislation*,  such  as  H  R. 

17M.  The  Electronic  Stgnatnres  in  Global  and  National  Commerce  Act,"  to  ensure  that 

consumers  are  adequately  protected  in  the  online  environment  Thb  MB  has  passed  the  House 
of  Representatives  and  Is  enrrenfly  the  subject  of  a  conference  with  the  Senate 

WTheNatinnMAsKt'daaon  of  Attorneys  General  has  commented  on  HJR.  1714  statingthat 

Pe^Te rl  SS* S!*°!,S*  otim^  «>»*'  "accurately  reflect" 
°frZ7„'  T  W  «  T  ?tbermse  re<*uires  retention  of  original  documents,  "has  the 

SIX*  “for“m“‘ disrov^ of 


•  •  *.\Nr>^v?yev> 
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StvI^l714  W?!d  tbM  State  enactmcnts  of  tfje  mirorm  ®ectnmlc  Transactions  Act 

(UETA)  be  consistent  with  the  House  bill,  resulting  In  federal  preemption  of  any  state 

PreS^Pr?  °JVaiidit>'  °f  dectr0nic  signatures  aBd  transactions  that  is  not 
authorized  m  the  House  bill.  The  National  Association  of  Attorneys  General  has  opined  that 

this  broad  federal  preemption  would  ’’unduly  hinder  the  ability  of  the  states  to  protect  their 

a8*®?.W»mer  fratld',,  »  States  are  hindered  in  combating  consumer  fraud,  would 
the  FBI’s  job  m  protecting  the  public  from  fraudulent  online  practices  be  made  more  difficult? 

‘  *  ■  * 

On  its  face,  the  provisions  of  H.R.  1714  which  allow  for  the  electronic  storage  of  contracts 
agreements  and  records  are  unrelated  to  earlier  provisions  of  the  bill  delineating  what  types  ofle^al 
documents  may  be  executed  by  electronic  signature.  To  the  extent  that  Section  101(c)(1)(c)  could  be 
interpreted  as  allowing  for  the  electronic  imaging  and  storage  as  an  electronic  record  of  written 
contracts  or  agreement,  die  tangible  originals  of  which  would  otherwise  be  required  by  law  to  be 
mamtamed  in  tangible  fonn,  then,  there  could  exist  the  potential  to  negatively  impact  certain  law 
enforcement  investigations  relating  to  such  documents.  At  a  minimum,  the  supplanting  of  tangible 
ongmals  (otherwise  legally  required  to  be  maintained  in  tangible  form)  with  electronic  images^ 

°nST  ’  'I"0  COtl?e4  With  desiructi0n  of  the  «*«*»>*  would  eliminate  or  complicate 
hmiwn tta  «gt» turean alysis  and  render  null  the  possibility  of  recovering  fingerprints  or  other  trace 

^  ^0ff  ginals.  By  the  same  token,  the  provisions  of  siSn  101(c)(2)  wS 

exempt  from  retention  data  relating  to  the  communication  or  receipt  of  any  contract,  agreement  or 
reeor  e  ectromcally  recorded,  could,  m  the  context  of  electronically  executed  contracts,  complicate 
or  eliminate  law  enforcement  efforts  in  tracing  the  source  of  transmission  of  fraudulent  transactions  or 
the  location  and  identity  of  co-conspirators  or  even  other  victims.  The  continued  trend  toward 
electronic,  paper-less  execution  of  commercial  transactions  (which  is  admittedly  so  critical  to  the 
continued  evolution  and  expansion  of  the  Internet)  when  coupled  with  l).the  growing  ability  of 
criminals  to  utilize  enaction  t0  restrict  law  enforcement’s  ability  to  recover  crucial  inculpatory 
evidence,  and  2)  the  absence  of  any  preeminent  public  key,  or  private  signature  verification  enfitv  or 

Le  fraud" COmpIiCateS  the  efroits  of  the  FBI  and  state  iaw  enforcement  to  protect  the  public  from  on- 

1.  synopses  only  of  documents  can  negatively  impact  law  enforcement? 

~  . ,  ,  ,  .  review  ?fcomPlete  mA  accurate  records  is  often  necessary  in  law  enforcement’s 

effort  to  help  investigate  cnme.  All  records  management  and  retention  policies  therefore  can  be  said 
to  have -an  effect  on  hw  enforcement,  and  those  polici  es  which  do  not  require  that  information  be 
mamtamed,  at  least  in  theory',  can  negati  vely  impact  law  enforcement’s  discovery  of  that  information. 

2.  If states  are  hindered * » . 

-  ’■  ■■  •  ■  . 

}ff,  „  ?!e  f81  believes that  since  States  am  the  primary  responders  to  crime  in  our  country, 

5th m  combatmS  consumer  fraud,  then  the  FBI’s  job  in  protecting  the  public 
from  fraudulent  online  practices  wold  be  made  more  difficult 
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•  9.-7 . 010  Introduction- 

■auSifn  ^n2r  £°nt*ins  department  of  Justice  policy  on  the  use  of  electronic 
SS  ?  ^efeaeral  electronic  surveillance  statutes  (commonly  ref  errs 

o?1JhAUiV^y  aS  T't1^  IU  )  are  codified  at  18  U.S.C.  $  2510,  at  sec.  Becaute” 
reco^i2ed  intrusive  nature  of  many  types  of  electronic  surveillance 
especially  wiretaps  ana  "bugs,"  and  the  Fourth  Amendment  implications  If $ZT 
government’s  use  of  these  devices  in  the  course  of  ?■  1  txe 

'  restr“ctiorr^  fh  refwed  De?artrasnt  of  Justice  guidelines)  provide 
th\us®  of  most  electronic  surveillance,  includino  the 

tw  D*p‘*°“nt  0t(ici41  »P«ci«e.Uy  awro«  th.  „ 

-  °f  eiectron~c  surveillance  prior  to  an  Assistant  United 
b  ^ing  a  C?Urt  orcer  auth°ri2ing  interception.  *  i 

7  co..«.axns  vhe  specific  mechanisms,  including  aopl<cab'’e  a^o**cvai 
for  the  use  Of  wiretaps,  "bugs"  (oral  intent ^  de5?cel)  ^ 
yXaeo  surveillance,  and  the  consensual  monitoring  of  wi~  or#o*>hl 
-communJ.uauions,  as  well  as  emergency  interception  procedures  Ld  rest-ict4r‘  ^ov 
>he  disclosure  and  evidentiary  use  of  information  obtained  ♦•hrouaWi^^ef" 

efect*onic  •in^rm8tion£concer*,lln5  use  of  the  various  tiroes  of  !i 

'  Attorneys  set,forth  ln  tha  Criminal  Resource  Manual  at  27. 

Op«mo£,  Ir^nS  ^vision  L-TitSL'blf  h°£  thL0f£iCe  o£  “^cement 

both  the  interpretation  of  Title  III  and  the  revie^procels^necessitated^10' 

surwi??!!:  IJt !rcFH^S  conducted  pursuant  to  the  Foreign  Intelligence 

Act  of  i978'  which  is  codified  at  50  U.S.C.  §  1801  et^ec  *** 

?f??^f?awyrCi??/d  froJa  the  covera9e  of  Title  in.  See  18  US  C 
2511 U). (a)  (n),  (2)  (e) >  and  (2}  <f> .  u.s.g.  § 

9-72  010-  . 

U 5S..  Attys,  Man.'  9-7.010 
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9-7 . 100 -Authorization  of  Applications  for  Wire,  Oral,  and  Electronic 
Interception  Orders — Overview  and  History  of  Legislation 

To  understand  the.  core  concepts  of  the  legislative  scheme  of  Title  III,  onk 
must  appreciate  the  history  of  this  legislation  and  the  goals  of  Congress  iji 
.  enacting  this  comprehensive  law.  By  enacting  Title  III  in  1968,  Congress 
prohibited  private  citizens  from  using  certain  electronic  surveillance 
techniques.  Congress  exempted  law  enforcement  from  this  prohibition,  but 
required  .-compliance  with  explicit  directives  that  controlled  the  circumstan 
under  which  law  enforcement’s  use  of  electronic  surveillance  would  be  permi 
Many  of  the  restrictions  upon  the  use  of  electronic  surveillance  by  law 
enforcement  agents  were  enacted  in  recognition  of  the  strictures  against 
unlawful  searches  and  seizures  contained  in  the  Fourth  Amendment  to  the  Uni 
States  Constitution.  See,  e.g,,  Katz  v.  United  States,  389  U.S.  347  (1967). 
Still,  several  of  Title  Ill’s  provisions  are  more  restrictive  than  what  is 
required  by  the  Fourth  Amendment.  At  the  same  time.  Congress  preempted  Stat 
in- this  area,  and  mandated  that  States  that  sought  to  enact  electronic 
surveillance  laws  would  have  to  make  their  laws  at  least  as  restrictive 
Federal.' law. 

One- of  Title  Ill’s  most  restrictive  provisions  is  the  requirement  that  Fed 
investigative  agencies  submit  requests  for  the  use  of  certain  types  of 
■electronic  surveillance  (primarily  the  hon-consensual  interception  of  wire 
oral  communications)  to  the  Department  of  Justice  for  review  and  approval 
'  applications  for  such  interception  may  be  submitted  to  a  court  of  competent 
jurisdiction  for  an  order  authorizing  the  interception.  Specifically/  in  18 
U.S.C.  §  2516(1),  Title  III  explicitly  assigns  such  review  and  approval  pow| 
to  the. Attorney  General,  but  allows  the  Attorney  General  to  delegate  this 
and  approval  authority  to  a  limited  number  of  high-level  Justice  Departmen 
officials,  including  Deputy  Assistant  Attorneys  General  for  the  Criminal 
Division-  ("DRAGS")',  The  DAAGs  review  and  approve  or  deny  proposed  applicati$: 
to  conduct  "wiretaps”  (to  intercept  wire  [telephone)  communications/  18  U.S 
2510(1))  and  to  install  and  monitor  "bugs”  (the  use  of  microphones  to  inter 
oral  { face-to-face]  communications,  18  U.S.C.  §  2510(2)}.  it  should  be  note$ 
that  only  those  crimes  enumerated  in  18  U.S.C.  §  2516(1}  may  be  investigat 
through  the  interception  of  wire  or  oral  communications.  On  those  rare  occa| 
when  the  government  seeks  to  intercept  oral  or  wire  communications  within 
premises  or  over  a  facility  that  cannot  be  identified  with  any  particular 
and.  a  "roving"  interception  of  wire  or  oral  communications  is* therefore . bei 
requested,  the  Assistant  Attorney  General  or  the  Acting  Assistant  Attorney 
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General  -for  the  .Criminal  Division  roust  be  the  one  to  review  and  approve  or  d 
the  application .  (See  the  roving  interception  provision  at  18  O.S*C  §  2518  ( 
discussed  at  USAM  9-7. ill.)  ;  '  ‘ 

In  1986,  Congress  amended  Title  III  bv  enacting  the  Electronic  Comunicatie 
,  Privacy  .Act  of  1986.  Specifically,  Congress  added  a  new  category  of  covered 
coronumidatlons,  i.e.,  "electronic  communications, *  which- would  now  be  protec 
and  whose  interception  would  be  regulated,  by  Title  III.  Electronic  ~ 

communications  are  those  types  of  non-oral  or  wire  communications  that  occur 
.inter  alia,  over  computers,  digital-display  pagers,  and  facsimile  (”fax«5 
. machines,.-. . See  .18  U.S.C.  §  2510(12). 

.Khj  l$$.§.  amendments  permit.  any  government  attorney  to  authorize  tb 
bt  an  '  electronic 

^congnuaxgattons  to  investigate  any  Federal  felony  (18  olsTcTs  2516  (3)  V  the 
SSPajtmjgnt  of 

^oactment  thgj^jfor.ji^^ ■  Depa r troen  t  approval  would  hohefhele 
fore_appJ. icstipns  ..could  be  .submitted” "to  ~  a~ , emir u ct ™ 

S5indSd4tH~lr rS~22£22^srsss~^§ii.2a§j. . r .  t he,  Depa rtroem 
nded^t,  h  pr  ipr^app ro  v  a  I  requirement  for  the  interception  of  e  i  »<.t  ,♦  ~ 

-aarSJa * 

h.  pzwx .  to  application  to  the  court  for  the  interception  o) 

jaaCiiinps.  Applications  to  the  court  for  authorisation  to  intercept  eUct^onif 
communrcatxons  over  digital-display  pagers-which  are  the  most  commonly  tSg 
type  of  electronic  communications— may  be  made  based  solely  upon  the  9 

authorization  of  a  United  States  Attorney.  See  18  O.S.c.  §  25X6(3) . 

^-^5-i^e.i®Ptdper„  and/or  unlawful  use  and 

- car'^na l7'  civil,  at 
the  suppression,  of  evidence,  it  ' is  ' 
LgHg* rff li^LSR^-Sg^tne^  agents'  clearly  underst 

...and!  whaT sudTa  process 

.^nwail^See  18.  U.S.C.  §§  2511,  2515,  2518 (10) ,  and  2520’.  - - -  * . """ 

ee  the  Criminal  Resource  Manual  at  31,.  for  citations  to  relevant  legislatic 

9-7.100  ;\ 
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;gMga;ayiston^ 

£g.vi.ew  of  the  necessary  pleadings,  which  include r  . ~ . . .  —  - 

affidavit  of  an  ’’investigative  or  law  enforcement  officer"  of  th*  Un*:  -ed 
fS  o4iw  15  ^P°w$reci/-V  iaw  ^0  conduct  investigations  of,  or  to  make  a-re^s 
fnoii f4iT<  snreratS  «  18  O’S.C.  §  2516(1}  or  (35  (which,  for  any 
an?  riderll  perception  of  electronic  communications,  include!  > 

investigation  that  establish  the  basis  for  tho^  Stable  cau^  ’and  oSe?f  ' 

■  sucPts  required  by  Title  III  to  be  included  in  the  application;  : 

SthS'eSiiS^Sfw^  St#t“  Mtorn*F  «  his/her  Assistant,  or  anv 

t*  o54mm  tLtllxlls  -  1°  ?r?!ecute  or  participate  in  the  prosecution 

numerated  in  18  U.S.C.  §  2516(1)  or  (3)  that  provides  the  basis  for 
.the  courts  jurisdiction  to  sign  an  order  author!  2ina  the  *&*+&<*  <-*__** 
or  wire/  oral,  and/or  electronic  communications;  and'  *  q  interception 

C*  A,  set  of  orders  to  be  signed  bv  the  cour^ 

.  IKercAt,  or  approving  the  i«.K.«ion  of,'  ?hl  Sl5J  f-S?*  Kd%f  ff  *°  . 

communications  that  are  the  subject  of  the  application,  Includinc 
redacted  orders  to  be  served  on  am;  ,suwa»/^  •  «  luc^uaing  sppucpriate 

.  e  servea  on  any  relevant  providers  of  "e’ectronir 
communication  service",  {as  defined  in  18  u.s.c.  §  2SiouS}}.~  ct~onic 

9-7/110;  •  : 
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9-60.202  .Illegal  Electronic  Eavesdropping — Prosecution  Policy 

The  .criminal  prohibitions  against  illegal  electronic  ^  , 

-  Title  111  are  part  of  the  same  act  which  S  eavesdropping  contains 

0fA-'.r-.  f  same  act  wnicft  permits  federal  law  enforcement 

thi  c*Si«r  SKcIil  fe  electronic  surveillance.  Congress  vie 

the  s^e  'Si  L  authorization  provisions  as  too  sides  c 

****** .  .CQin *  ifia  r$tSntiOTl  ot  th&  COV&^nmpnt  *  <?  AMfhAH  4*  , 

court-authorized  electronic  surveillance  may  depend  on  it^iL^^T  171 
r>f  the  OTu'tinnc  <  Ti  ^  '  .  *  :  *  ucpcu«  on  its  vigorous  enforces 

the  DepK-men^J  iSS  V 1 €ifctronid  eavesdropping.  Accordingly,  it  i 
zne  uepar^ment  $  policy  x.a  vigorously  enforce  these  ^  x 

The  rtrrtent T  rvtfr&r'ai  i  *  ♦  v  ^rn^neti  prohibitions  - 

■pi&ar^J*OT  osrso°s  P°llCy  “nder  18  0-s-c-  *  »H  is  to  fo 

ps“  of  ts?  "J°  ®«a»e  “  Ptsttro  illegal  electronic  surveillance  a 

ox.  tae  practice  or  their  profession  or  ^  - 

set ^ f  »  >  *  ,  ■  ^ ^  incident  their  husines^ 

uCt^Vities .  ^ess  emphasis  snoula  be  placed  on  the  *"  , 

the  course  of ■ trans^ torv  a«3xj v^on  persons  who 

without  tL  LslStce  ^  a  Ce?t  COattauRicatio»*  o»  their  own 

,  *-ue  «a»wscance  ox  a  professional  wiretaooer  or  ^sme«<Mhv,n.  .  , 

not  mean  that  such  persons  are  never  to  be  prosecuted!,  but  iixtll  tLr^h- 

Cvn?f°SnUti?n.:LS  n0t  a  ma3°r  thrust  of  theDepartmenfs  enforcement c-S™™ 

rSlti 

enforcement,  and  [5)  intra-business!  The  laroest^uSer^f^nterceptions 
than  75  .percent,  are  in  the  domestic  relations  a*!££. 

communiStionrwhSh  ®n<*  prosecute  illegal  intercept  ions  ?f 

enforcement,  and  intra-business  cateoories  General? ttlt  JJ  f  ^0nage'  law 
interstate  ramifications  which  win  make  federal  nraL™fh  Vloiatlons  wil*  be 
pecs eeption .  Nevertheless,  in  esses  Seri Se  fS  TS  tD  st 

be. appropriate  to. defer  to  state  prosecution.  1  interest  15  slight,  it 

Illegal  Interceptions  arising  from  domestic  relatierc 
present- less  of  a  federal  interest  and  therefore  i«L flsputea  generally 
appropriate.  However,  this  doeStot “L  the?  is 

soaicate  responsibility  for  prosecuting  such 

the  preponderance  of  this  kind  of  <  nterceot^  on*  no  *tions'  Indee<i'  in  view  o 
effective  without  the  initiation  of  some  prosecution^fn^?^  prograra  can  b« 
United  States  Attorneys  should  develop  effective  li^Lln  JtfV**^*  ?ur?oses 
in  order  to  convince  them  to  shoulder  their  share  of'the  P^^ecuto 

private  detective,  attorney,  tIZy'Zicyt?  ^ 
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•  fteevto '-pursue  these  cases  or  refer  t-w  fS*,knited  states  Attorneys  should 
.pwfessikal  should  e^p!  orofSll  \t0  l0Cal  P“*»«*tors,  hoover,  no  , 

'  eoMSCio  relations  violkions  ®3ch  do“™?  ?  case  exists. 

.are  the. lowest  priority  cases  for  federal J  *nvolv?  a  professional  intercept© 

ISStfci*  n°f“Uy 

eiOlatlotiS'  ofthkl“£5  »ilie?ometimesSprSe°to”'be  "j  •»«»»»*«••  M»i«Mh2h 
warrant  either  federal  or  state  pS?Suti?n  in  «u-f  insufficient  magnitude 
prove . sufficient,  -  for  example,  a  civil  suit* for  rfA«*rtCas?fi  othee  measures  xn£ 
suppression,  of  evidence  m  U.S.C.  §  2515}*  or  foSi*uJ  S  2520> ' 

eavesdropping  paraphernalia  {1$  D.S.C.  ^  551  *?i  si^ure  0..  uhe  wiretapping 
.  wxsturbed  persons  often  susoect  that  *Hpv  a  »-&**>> 

Si.fff  — ’  complaint  »h“h  Ule«al 

the  th!  tel«P^n«  normally  does  not  SUSpicious 

the  laiwial  line  check  fails  to  produce  IndependStivIdeSe^  Qf H^tion 


if 


$-60,202;  , 
t'.S.  Attys.  Han 
JESb  OF  DOCUMENT 


$-60,202 


ss, 

to 

y 

or 


Copr.  ©  West  2000  No  Claim  to  Orig.  u.S. 

, ....  . 


Govt.  Work* 


5/24/02  Release  -  Pa«44l? 


PQjCOHPUTS?CRIf€$  /..  Fax:3025i46113 


"'***"'%  1  Tp? 


Citation  ' , 

U.S.. 'Attys.  Man.  9-60.262 
0 .6 .  Attorney ' s'  Manual  9-60 . 2 62 

TEXT  ••  :  - 


JuS  2- '<00  18;35 


R.  08 


Search  Result 


Rank  17  of  18 


Datafc 

USAhl 


UNITED  STATES  DEPARTMENT  OF  JUSTICE 
UNITED  STATES  ATTORNEYS  MANUAL 
:  :  .  .  TITLE  a-CRIMINAL 

;  -  .  CHAPTER  9-60.000  PROTECTION  OF  THE  INDIVIDUAL 

September  1997 

9-60.262  Prosecutive  Policy — 18  U.S.C,  $  2512 

Flagrant  violators  of  18  U.S.C.  5  2512  should  be  prosecuted  viaorou^w 

especially  violators  who. possess  such  devices  in  order  to  engao«  in  elee<-rnn4 
surveillance, as- a  business.  engage  in  electron! 

^Less  culpable  first  offenders  and  those  who  violate  the  «•*-*<-)>*'*  u.-..,,.  - 

ignorance  .of  the  law  may  be  appropriate  «ubiec*s  !?1  because  of 

"In  soi»>»>>a«a« •  a  -  TFh  lt  ~,  SUDJects  tor  more  lenient  disposition 

-24S5  J!  a  warning  may  be  sufficient.  Nevertheless,  in  all  cases  ev«S 
perhaps,  for  minor  advertising  violations,  the  United  s-at*e 

snoold  resuire  th»t  th.  prohibited  device  either 

the  FBi  or  forfeited  pursuant  to  18  U.S.C.  §  2513.  voluntarily  to 

9-60,262 . 
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7/20/00  6:20PM 
Don  Kerr's  Testimony 


The  revisions  that  t  just  gave  you  do  not  include  a  fix  for  the  problem  that  we  just  discussed  nameSv  the 
difference  between  T-lil’s  standards  for  interception  of  oral/wire  communications,  and  those  for  electronic 
communications.  The  former  are  set  forth  in  18  use  2516(f),  the  latter  in  18  USC  2516(3), 

For  the  purpose  of  this  testimony,  the  two  main  differences  are: 

(1)  that  applications  under  2516(3)  do  not  require  senior  level  DOJ  approval  and  (2)  that  they  are  not 
limited  to  "certain  federal  felonies.  Tte  if  *  strike  the  sentence  at  Sie  bottom  of  Jage  Sop  of  page 
three  (refemngto  authorization  by  a  senior  official  of  DOJ)  and  the  last  sentence  in  the  first  paragraph 
of  page  three  (“Further,  interception  of  communications  is  limited  to  certain  specified  felony  offenses  n 
we  will  remove  some  of  the  misleading  Inferences  as  to  which  provision  we  follow  when  seekinc  court 
approval  to  intercept  e-mail.  There  may  may  be  other  instances  where  the  testimony  suaoests  that  we 
use  2616(1)  rather  than  2518(3);  OGC  should  scrub  the  testimony  again  to  cSTorSSncS 
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DELETED  PAGE  INFORMATION  SHEET 

_ Page(s)  withheld  entirely  at  this  location  in  the  file.  One  or  more  of  the  following  statements,  where  indicates 

explain  this  deletion. 

D  Deletions  were  made  pursuant  to  the  exemptions  indicated  below  with  no  segregate  material  available  for 
release  to  you. 


Section  552 

Section  552a 

o  min 

:  □  (b)(7)(A) 

D  (d)(5) 

□  0>)(2) 

□  (b)(7)(B) 

□  0X2} 

O  (b)(3) 

□  (b)(7)(C) 

0  00(1) 
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O  0c)(2) 
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O  (b)(7)(F) 
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□  (b)(4) 

□  (b)(8) 

□  (k}{5) 

□  (b)(5) 

□  (b)(9) 

□  <k}(6) 

□  (b)(6) 

□  (k)(7) 

□  Information  pertained  only  to  a  third  party  with  no  reference  to  the  subject  of  your  request  or  the  subject  of  yc 
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■  sSwBigssMMb . 

v.asadj£ed  ha{  next  week  there  wii  be  House  hearingsandthatDnKerr  and  yoSSHHH 
teduBKoSJof^ CarSnTr^' £enJ wlll,resd  an  °Pe”if5S  statement  that  wit!  incorporate  both  the 
^|||||pnd||^|vi[j  writelhe^statement6^3  %  f°r  itS  USe'  If  thiS  meete  with  *our  Wval,  *»#> 

toc2id°2  **i StW«?c  Pa^a9o  that  can  be  installed  in  box  that  can  easily  blend  with  other  devices 

mSnifo,  XP'  V-  l used  und8r  cotJrt  3rder* «  &  not  a  continous  running  system.  The  software  is 

wientrf' atfi  k  fnt  t0  a  fie!d  off5ce  when  needed*  ft  was  developed  by  us  because  we 

were  not  able  to  diferentiate  between  customers  and/or  messages.  Jugdes  were  authorfrim  v*rv  nafr™, 

SrnSe  “snlffc"  uo  from  Sr?”’?  {°  "T?  °ur  interception  UP  *»«  rather  that  with  post-minimization 
intercept  ff  P  *  d  captures  only  those  e-mails  we  are  authorized  to  intercept  or  wnai  to 

d°t1hif  i{  d06S  this  ,housh  a  series  of  S'ters.  The  filters  allow  you  to  exclude  those  e-mails 

whh  h?m?i?r^S  vn  examp!e ' m*  5ubiect  of  your  case  is  represented  by  counsei  and  communictes 
with  him  via  e-mail.  You  can  program  Carnivore  so  that  you  wit!  not  capture  these  e-mails  OrwaiSSt 

iS  "*  **  T  311  his  Web  <M»-  »  brousinglhrough^cSalogues  '  ** 
pmtSofnofSo?  intercepts  just  to  web  mail.  Therefore,  it  is  adauliy  a  privacy 

Data  is  not  stored  on  the  Canivore  device,  it  is  stored  on  a  disc  or  zlp-drve  that  is  locked  bv  kev  hv  ih* 
f9«  f «  craved  only  by  too  agent  so  ss  to  nraintian  chain  of  custody  The  hSc  is  toe„ UZS Cck 

at  the  fifw  °rfCe  f  nd  p!aced  ,n,o  s  readm9  device.  There  is  an  additional  minimization  step  the ft  occurs 
n  .rer/ ?f  to  ensure  that  the  case  agent  does  not  read  any  e-mails  that  he  is  not  authorize  to  use 

ih8caLift  °,rdfr-  ^e  may  have  information  up  front  that  allows  us  to  filter  e-mails  but  there 
m  I? 3  r  e  d.e  erm,rf tfirou9ht  the  course  of  toe  intercept  that  there  are  e-maiis  we  can’t  have 
fhT™  f  tT  t Jam!Vdre  intercepts  are  not  real  time,  we  need  to  post  minimize  Once  we  ieam  that 
we  Sl?« ™S so  back  to  me  device  and  add  Sites  to  toe  program  so  mat 

*ab8nded  tw0  £b«^fings  last  week.  One  was  with  the  Judiciary  Committee  minority  staffers  They 
seemed  more  interested  in  understanding  how  Carnivore  works,  how  tong  we  have  been  using  it  for 

m.frt?^0^868  3nd  *frepu,te  con!ent  ones  they  Seamed  that  we  only  use  Carnivore  pursuant  to  a 
court  order.  They  seemed  quite  satisfied  with  the  briefing. 
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FBI’s  Wiretaps 
To  Scan  E-Mail 
Spark  Concern 


By  King  Jr. 

And  tm  Bmms 

S^f  UepKTiers  0/Tuk  Wall  *****  J^kkal 

WASHINGTON -The  Federal  Bureau 
m  investigation  is  using  a  superfast  sys¬ 
tem  called  Carnivore  to  covertly  search 
e-mails  for  messages  from  criminal  sus- 
pect$L 

Essentially  a  personal  computer 
stuffed  with  specialized  software,  Carni¬ 
vore  represents  a  new  twist  in  the  federal 
government’s  fight  to  sustain  ffs  snooping 
powers  m  the  Internet  age.  But  in  employ¬ 
ing  the  system,  which  can  scan  millions  of 
smalls  a  second,  the  FBI  has  upset  pri¬ 
vacy  advocates  and  some  in  the  computer 
industry.  Experts  say  the  system  opens  a 
thicket  of  unresolved  legal  issues  and  pri¬ 
vacy  concerns.  p 

The  FBI  developed  the  Internet  wiretap' 
ping  system  at  a  special  agency  lab  at 
Quanto,  Vsu,  and  dubbed  It  Carnivore  for 
Its  ability  to  get  to  “the  meat^  ofowhai 
w’ould  otherwise  he  an  enormous  quant! fy 
or  data,  FBI  technicians  unveiled  the  Sys¬ 
tem  to  a  roomful  of  astonished  industry 
specialists  here  two  weeks  ago  In  order  to 
steer  efforts  to  develop  standardized  ways 
of  complying  with  federal  wiretaps, 'Fed¬ 
eral  investigators  say  they  have  used  Car¬ 
nivore  in  fewer  than  100  criminal  cases 
since  Its  launch  early  last  year,  ■ 

Word  of  the  Carnivore  system  has  dis¬ 
turbed  many  in  the  Internet  Industry  be¬ 
cause,  when  deployed,  if  mixst  be  hooked 
directly  into  Internet  service  provided 
computer  network.  That  would  give  the 
government ,  at  least  theoretically,  the  abii- 

ity  to  eavesdrop  on  all  customers’  digital 
communications,  from  e-mail  to  online 
banking  and  Web  surfing. 

The  system  also  troubles  some  Internet 
service  providers,  who  are  loath  to  see 
outside  software  plugged  Into  their  sys¬ 
tems.  In  many  cases,  the  FBI  keeps  the 
secret  Carnivore  computer  system  in  a 
locked  cage  on  the  provider's  premises, 
with  agents  making  daily  visits  to  retrieve 
w  the  data  captured  from  ihejproviderts  net¬ 
work.  But  legal  challenges  to  the  use -of 
Carnivore  m'e  few,  and  judges’  rahngs^e-h 
main  sealed  because  of  the  secretive  ©a* 
tee  of  the  Investlgatipns,  ’  : : 

&rc  conducted  only, 
under  state  or  federal  judtdsl.o^  and 
oceurreMv^  inffepente  The 
jorit^of  wiretaps  continue'^o  he  thetradi^ 

dSa fm*m 


TO;  The  computer  indostfy  4,  j;: 

mo^TheFBf 


DATE  jjjj 
FAGE/^h^ 

{ 22BCT 

\Y$C ■  mz  V ^ V  ^  ^ 


j  1*  The  FBI  installs  one  of  its  off-the-shelf  PCs  at  the  Internet  service  provider  of 
the  surveillance  target 

2*  The  PC  checks  e-mails  passing  through  the  ISP  for  information  that  indicates 
whether  an  e-mail  is  going  to  or  from  the  target. 

3*  if  it  is,  the  PC  copies  the  full  text  of  the  e-mail  to  the  PC's  removable  hard 
dnve,  which  an  FBI  agent  collects  daily. 

4*  While  it  does  analyze  the  destination  and  sender  of  other  e-mails  Carnivore 
does  not  retrieve  their  full  text. 

S*  Once  the  surveillance  ends  (average  45  days),  an  FBI  agent  gathers  the 
computer  from  the  ISP.  ' 


Is  growing  as  everyone  from  drug  dealers 
to  potential  terrorists  begins  to  conduct 
business  over  the  Web, 

The  FBI  defends  Carni  vore  as  more  pre- 
;  me  than  Internet  wiretap  methods  used  in 
me  past.  The  bureau  says  the  system  ah 
I  lows  investigators  to  tailor  am  intercept 
operation  so  they  can  pluck  only  the  digh 
1  ™  traffic  of  one  person  from  among  the 
|  stream  of  millions  of  oilier  messages.  An 
aptly  code-named  Onrni- 
1 jg.uld  suck  In  as  much  as  to  six  gh 
gabytes  ;of  data  every,  hour;  Mi  In  a  less 
vf  /, 

Tv **PV  contend  that  Carnivore  is 
:  open;fo  abuse>v-'  Vy- V*  > 

\  4 -i&firfc  Easchv'a  former  federal  com¬ 
puters^  prosecutor,  said  the  nature  of 

f; taKt^pri^cy  quesfionmm&ce  it  ImaS 
:  part  <jf  every  snippet  data  tramc  that 

Swpast,  if  only  to determine  whether  to 
record  it  for  police,  >.  .  ; 

; ; :  "ft’s  the  electronic  equivalent  of  Men- 
j  Everybody’s  pirate  calls  to  see  if  ft’s 

h  w*.  7m  de^<aSen- 
I  dons  amount  of  Mormafiom* 

!  Others  say  the  technology  dramatizes 
how  far  the  nation’s  laws  are  lagging  be-  ' 
hind  the  technological  revolution  *This  is 
a  clever  way  to  use  oid  telephone-era  stat- 
fts  to  meet  new  challenges,  bn?  clearly 
there  is  too  much  latitude  in  the  current 
law.  said  Stewart  Baker,  a  lawyer  special¬ 
izing  in  telecommunications  and  Jhteraei 
regulatory  matters.  .  -™1 

Robert  Cora-Revere,  of  the  Hogan  $J  ' 
Hartson  Jaw  firm  here,  represented  an  Vf 
derailed  Internet  sendee  provider  in  on, !  i 
of  the  few  legal  fights  against  Carnivoro  ~ 

!  Me  said  his  client  worried  that  the  W 
;  wotdd  have  access  to  all  toe  e-mail  trafa<  :  i 
pn  .its  system,’  raising:  dire  privacy,  ant  I 
security. .concerns.  A  federal, magistrate  f I 
ruled  against  toe  companyaarly'thls  year  !  I 
leaving  it  no  .option  hut  to  allow  toe  FBI  I  * 
access  to  Its  system,  ’■  .  { 

i  &€£&]*  to  desperate  need  of 
clarification  from  NCtagres$,£;M$t  Afir.v 


Com-Revere. 

,  software  is  applied  to  toe 

ISP,  there  $  no  check  on  the  system,"  said 
Hep,  Bob  Barr,  R-Ga,,  who  sits  on  a  House 
judiciary  subcommittee  for  constitutional 
affairs.  ”If  there’s  one  word  1  would  use  to 
describe  this,  If  would  be  brightening,1” 
Marcus  Thomas,  chief  of  tlie  FBI’s  Cy¬ 
ber  Technology  Section  at  Quanto/ said 
Carnivore  represents  the  bureau’s  effort 
to  keep  abreast  ofrapid  changes  in  Inter- 
t»t  communications  white  still  meeting 
.  the  rigid  demands  of  federal  wiretapping 
statutes.  “TJiis  is  just  a  very  specialized 
sniffer,"  he  said.  .  •  > .*  Y 

'He  also  noted  toat  criminal  and  civil 
penalties  prohibit  the  bureau  from  placing 
unauthorized  wftetaps,  and  any  informa¬ 
tion  gleaned  ,is  those  types  of  criminal 
ca^e$  would  .be  thrown  out  of  court  Typi- 
eal  Internet  wiretaps  last  around  is  days, 
after  which  toe  FBI  removes  the  equip¬ 
ment.  Mr.  Thomas  said  toe  bureau  usually  ‘ 
has  as  many  as  26.  Carnivore  systems  on 
hand,  "just  in  case.*’ 

FBI  experts  acknowledge  that  Cami- 
TOre’s  monitoring  can  be  stymied  with 
computer  data  such  as  e-mail  that  is 
scrambled  using  powerful  encryption  tech, 
oology.  Those  messages  still  can  be  cap- 
,  lured,  hut  law  officers  trying  to  read  the 
contents  are  “at  the  mercy  of  how  weii  it 
was  encrypted,”  Mr.  Thomas  said. 

Most  of  toe  criminal  cases’  where  the 
,  usf«  Carnivore  is  toe  past  18  months 
focused  on  what  toe  bureau  calls  “infra¬ 
structure  protection,"  or  the  hunt  for  hack- 
ers,  though  it  also  was  used  in  counterter- 
ronsm  and  some  drug-trafficHng  cases 
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?  !ibert?S  30(3  pnvacy  9rouPs  are  raifin9  against  a  new  system  designed  to  allow  law  enfomemarif 

>  336015  to‘rrfen^9t  ^  *■*»  huge  amounts  of  frmalt  In  connection  with  an  investigation.  enforcement 

D»^«n.  c*M  "Cab*™/ was  tot  hinted  at «.  Apdl  6  in  testimony  to  a  House  subcommittee.  Now  the  FBI  has  a  In  4 

^^^olaSi''p^.,”W,  S^“  ^  “  “«  «“  and  outdoing  emails  Mr  messages  associated 

to  a  fetter  addressed  to  two  membereofthe  House  subcommittee  that  deals  with  Fourth  Amendment  *  ,«  ■'  - 

2£S;r  CiVl Ub!?s  Union  Sf3ued  «*  ^  breaches  the  IniemTproXs “** 

customer  by  reading  both  sender  and  recipient  addresses,  as  wet!  as  subject  lines' 'of SnX 2S? ? ItS  „ 
copy  of  the  entire  message.  M,>®* 01  10  decide  whether  to  make  a 

Further,  while  the  system  Is  plugged  into  the  internet  provider's  systems  it  is  conimiteH  cntAii.  k„  #>.* ,  , 

m  a  traditional  wiretap,  the  tap  is  physically  placed  and  maintained  by  the  telephone  c^y  enforcement  agency. 


.XfSSiSSS' *£Z1£  Sf, SS1?  SUCh  8  da"a',  -  “*  ■»  <-** 

p  Ano  even  then,  he  said,  the  data  mined  by  Carnivore,  particularly  subject  tines,  are  already  intrusive, 

*»t  _ _ _ r _  .  .  ..  -  ... 


congressman  had  no  com^nt  oilhe  leden  ’  V*°  he3dS  the  H°USe  Judlc,afy  subcommittee  on  the  Constitution,  said  tin 

In  testimony  to  Canady?s  subcommittee,  Robert  Com-Revere,  a  lawyer  at  the  Hoonn  A  Mart*™ »«  «  -  u. 

W«ed  anhtemet  proper  that  reused  to  install  the  CamiJTsysf^  T^eprewdemroacJ^  ZZ^T'  ^  he 
Cmn4tewre  said,  because  the  comoanvfo»mrfc.  «»«■&««,  A<,mf a  >  7  pmuaer  was  placed  in  an  awkward  posit  on,* 

use  me  company  feared  sorts  from  customers  unhappy  with  the  government  looking  into  all  the  •«£ 

It  was  asdtnowledged  ^»y  the  government}  (hat  Carnivore  wauid  enable  remote  ar*r*ec  r«  »r.c»  icto*  /  •  ,  ••  d* 

the  exclusive  control  of  government  agents,*  Com-Revere  said.  access  to  the  ISP  s  network  and  would  be  under 

Com-Rewre  told  the  committee  that  current  taw  {$  insufficient  to  deal  with  Carnivore's  mtentmi  «,  .  ,  . 

%£££%?  pm,  beau*.  of ft.  ftten*  conation  toiepb,™  to*. « that  ft  SSdtST 

not  tewuui  ft.  namu  of  his  cbent,  ant)  the  cti.pt  tost  ft.  cas..  H,  aaM  ft.  FB,  bos  bum,  Cami»m  sine 
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going  on  for  a  year  and  nobody  knew.” 

Reno  ordered  review 
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espondmg  to  concerns  raised  last  week,  Reno  ordered  a  review  of  Carnivore  but  has  no  elan<? 
order  the  program  suspended,  officials  said  *  °Uthan° 


today. 


mg 


“**  "* sbc  “d",UKls  il  ^  ^ ft  is  i** 

adequately  addressed.”  '  • 

'The  keys  to  the  kingdom' 

R^.  Bob  Barr  -  who  described  the  Carnivore  system  surveillance  abilities  as  "frightenine"  ~ 
tnay  demand  similar  restraints  at  a  congressional  **  ® 
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New  wiretap  rules  sought  * 
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S2. l£Z£Z£i£^  W“le  a‘ "*  “»“«”*  «•  Ws  ability 

The  ACLU  said  the  White  House  did  not  go  far  enoueh  in  in  r^sr.n«c  ,  * 

surveillance  powers.  S  gh  1  te  resPonse  to  increasing  government 
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CONGRESS  OF  THE  UNITED  STATES 

1207  lONGWOBTH  HOUSE  SUJIOiNG 
WASHINGTON,  D  C,  20515*100? 


July  24,  2000 


COMMITTEES 

JUOIDAfiy 

BANKING  ANO  FINANCIAL  StRViC 
GOVERNMENT  RffORM 

SutHttmtottiet  i *fy 
D<u§  Pottcv,  *«■ wj  Hum* a  Rtsow^ei 
VICE  CHAPMAN 


The  Honorable  Louis  i.  Freeh 
Director 

Federal  Bureau  of  Investigation 
935  Pennsylvania  Avenue  NW 
Washington.  D.C.  20535-0001 

IN  R£:  Request  for  Information  Pertaining  to  Carnivore  Svstero. 

Dear  Director  Freeh: 

In  light  of  the  recent  disclosure  of  the  Bureau’s  use  of  Carnivore,  and  given  the 
substantial  public  interest  in  this  matter,  J  hereby  ask  to  review  all  records  concerning 
the  Carnivore  system. 

Included  in  the  records  should  be  : 

*  A  description  of  Carnivore ’a  capability 

►  A  history  of  Carnivore’s  development  and  use 

*■  The  number  of  cases  in  which  Carnivore  has  been  used,  and  the  number  of 
Internet  Service  Providers  (ISP)  that  have  had  the  system  installed. 

*  An  analyses  of  the  legal  issues  the  Bureau  considered  before  deploying  the 
system. 

White  t  wuuid  welcome  any  explanatory  information  the  Bureau  is  willing  to  provide 
in  response  to  my  inquiry,  I  am  requesting  the  original,  source  documents 
themselves,  and  would  like  to  receive  them  before  August  7,  2000.  Given  the 
potential  impact  on  the  public  of  Carnivore,  I  would  like  to  make  the'  material  I 
receive  public,  and  would  like  the  Bureau  to  authorize  this  public  release. 

Thank  you  for  your  cooperation.  If  you  have  any  questions,  please  contact  my 
Legislative  Counsel,  Keri  Allin,  at  202/225-2931.  I  look  forward  to  reviewing  the 
information. 
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The  Honorable  Louis  i.  Freeh 
July  2000 
Page  2  Tf 


With  ki^cTregards,  lyemain, 
very  t 


Member  of  Congress 

i-' 


BB:ka 

cc:  The  Honorable  Janet  Reno 

The  Honorable  Dennis  Hasten 
The  Honorable  Richard  Ar$tey 
The  Honorable  Tom  DeLay 
The  Honorable  J.C.  Watts 
The  Honorable  Dan  Burton 
The  Honorable  Henry  Hyde 
The  Honorable  Charles  Canady 
The  Honorable  BUI  McCollum 
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By  STEPHEN  LABATON 


'M-  Washington 

IN  IS&,  the  Supreme  Court  took  up  the " 
ease  of  Roy  (Big  Boy)  Dims  lead,  a 
bootlegger  whose  phones  had  been 
tapped  fey  federal  agents  without  a  war¬ 
rant  The  court  ruled  that  evidence  obtained 
fcn  that  way  was  legal,  prompting  a  remark-  * 
able  dissent  by  Judge  Louis  D,  Branded 
*fThe  progress  of  science  in  f  urnishing  the 
government  with  the  means  of  espionage  is 
not  likely  to  stop  with  wiretapping”  Justice 
Braudels  wrote  in  a  dissent  that  the  court 
adopted  as  the  law  nearly  40  years  later. 
"Ways  may  some  day  be  developed  by 
which  the  government,  without  removing 


The  White  House  proposed  replacing 
these  illogical  distinctions  with  a  uniform, 
rational  set  of  standards.  Civil  liberties  and 
privacy  groups  support  this  idea  In  princi¬ 
ple,  but  are  highly  critical  of  the  arfmfolsf  ra- 
tion  for  refusing  to  explain  how  broadly  it  j 
intends  to  use  Carnivore  or  to  describe  what 
safeguards  are  in  place  for  preventing  its 
abuse,  •>.  ....  , *  • 

*Law  enforcement  officials  say  that  com¬ 
puter  systems  like  Carnivore  are  necessary 
because  e-mall  is  becoming  more  frequent¬ 
ly  used  for  communication  among  crimi¬ 
nals,  And  the  officials  note  that  these  cyber- 
monitors  can  actually  be  set  to  record  com¬ 
munications  much  more  selectively  than  a 
phone  tap. 

Carnivore  could,  for  Instance,  be  pro¬ 


papers  from  secret  drawers,  can  reproduce  (  grammed  to  pick  up  the  e-mail  from  only 


them  in  court,  and  by  which  It  will  be  . 
enabled  to  expose  to  a  jury  the  most  inti- ; 
.  mate  occurrences  of  the  home,”  : 

>  Thanks  to  the  ubiquity  of  e-mail  and  the  i 
ingenuity  of  the  FJS.L,  that  day  has  arrived. 
Over- the  last  couple  of  weeks  it  has  been 
i  Widely  reported  that  the  F.B.L  is  now  using 
■itvcomputer  .  program  called  Carnivore, 

•  which,  once  installed  on  the  network  of  an 
^internet  service  provider,  can  troll  through  * 
►millions  of  e-mail  messages  and  hone  in  oo  f 
rtfce  electronic  correspondence  of  suspects. 


O  far*  the  FJ5I.  has  reported  using 
program  fewer  than  25  times 
since  ft  was  developed  18  months 
ago,  but  that  number  Is  expected  to 
grow  quickly,  since  the  bureau  expects  It  to 
become  an  indispensable  law  enforcement 
tool*  particularly  in  international  espionage  , 
;  and  terrorism  cases. 

f .  That's  fete,  say  critics,  but  Carnivore  is 
{also  capable  of  simultaneously  monitoring 
■  fee  communications  of  people  not  suspected 
of  a  crime.  That  has  caused  civil  liberties 
♦groups  and  privacy  advocates  to  worry  that 
Hie  technology  might  be  used  to  monitor 
•unpopular  groups  or  political  enemies,  and 
[not  just  suspected  criminals, 
p  Lest  week,  as  lawmakers  on  Capitol  Hill 
began  voicing  their  concerns,  fee  White 
‘f&atse  moved  to  calm  fee  growing  storm, 
gfotai  Foteta,  fee  presidents  chief  of  staff, 
Stehned  fegfeiafere  proposals  feat  would  set 
Ig^requlreme^  for  surveillance  in  cy- 

agrees  that  some  kind  of  fegls* 
IjtfepM  needed  to  make  sense  of  fee  extst- 
of  laws  *6tsd  court  caseym 
present,  fojpex'  #« 

conversations^ 


DATE 


'O  , 


Uft.lhi  i{{Xf 

Sis?  Brot 


one  .sender  and  a  particular  co  mputer*  while 
excluding  such  e-mail  as  messages  to  or 
from*  say.  the  sender's  lawyer  or  wife. 
Phone  taps*  on  fee  other  hand*  pick  up 
everything. 

At  a  news  briefing  on  Friday,  top  F.BX  f 
officials  also  announced  plans  to  submit 
Carnivore  to  analysis  by  independent  aca¬ 
demics.  and  noted  that  the  system  kept  a  Jog 
of  what  It  was  asked  to  pick  up*  which  could 
be -used  by  a  court  to  spot  any  violations* 

in  making  their* case*  supporters  of  cyher- 
suryeiiiance  say  that  the  only  way  to  track 
e-mail  is  by  combing  through  all  of  fee 
messages  on  a  particular  network*  because 
e-mail  consists  of  a  series  of  digital  packets 
that  are  broken  apart  at  fee  sending  end  and 
transmitted  along  multiple  electronic  paths 
before  being  reconstituted  by  the  recipients 
f  computer. 

Nonetheless*  privacy  groups  and  some 
Internet  service  providers,  or  l.S.P/s,  say 
there  remains  a  less  intrusive  alternative.  , 
The  providers*  like  ACL  or  the  Microsoft 
Network*  could  be  ordered  by  a  court  to  fern 
over  specific  material*  rather  than  give  the 
FJ3X  unlimited  access  to  a  network.  That  is 
precisely  bow  telephone  companies  are. 
treated;  they  cooperate  with  warrants  for 
wiretaps  and  lists  of  telephone  numbers 
called  from  a  particular  phone. 

"The  real  question  Is  who  should  be  In 
control,"  said.James  3t  Dempsey,  staff  at¬ 
torney  for  the  Center  for  Democracy  and 
Technology,  a  civil  liberties  group  in  Wash¬ 
ington,  "It  upsets  fee  balance  among  com¬ 
peting  interests  and  privacy  for  faw  en¬ 
forcement  to*  fe  essence*  kick  the  companies 
out  of  the  way,  hookup  a  black  box^and  say, 
6m*t*imdkiV$  *  ^  An¬ 

other  experts  said  featdt  was  timedora  t 
reappraisal  of  all  the  standards  used  byithe 


tored  by  computers  and  more  easily 
masked  by  encryption. 

As  even  household  appliances  begin  to  be 
wired  Into  the  Internet  and  many  of  our 
most  personal  thoughts  and  associations  are 
ndw  shared  with  the  computer,  the  issue  has 
taken ^on  a  new  imperative  and  is  -being 
debated  on  a  global  scale. 


THE  British  government  (whose 
house-to-house  searches  in  the  Eng¬ 
lish  colonies  led  to  fee  Fourth 
Amendment 'prohibition  against  un¬ 
reasonable  searches)  Is  near  to  adopting  a 
law*  the  Regulations  Investigatory  Powers 
Bill,  or  RXP„  that  would  require  Internet 
sendee  companies  to  finance  the  permanent 
Installation  of  a  Carnivore-like  system  for 
government  use, 

A  similar  system  Is  already  in  place  ,  in 
Russia*  while  In  the  Netherlands  a  debate  Is  , 
raging  over  whether  fee  government  should  . 
have  fee  authority  to  tap  into  e-mail  at  aliv* 
"Thtsdebate  really  cries  out  for  a  return 
to  first  principles”  yakS  Marc  Rotenberg. 
director  of  fee  Electronic  Privacy  Informa¬ 
tion  Center*  a  research  organization  feat 
studies  privacy  Issues  and  technology. 
Among  fee  most  Important  of  such  princi¬ 
ples,  he  said*  is  that  the  government  should  : 
always  use  fee leak 

■■to®*#* 


lllgjt 

a'  ■ 


me  wono-meves  vi  ^ 
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hcasmss  011  -■  t  # 

^LINE:  De!  Quentin  Wilber  ,  ,  4  . 

SOURCE:  SUN  NATIONAL  STAFF  : 

V#"' 

BOOT: 

SLb?fSS?vi«  Si?*  proc.ess  of  siftb§  out  Communications  from  its  targets.  Carnivore  is  also 
capable  of  retrieving  the  private  messages  of  innocent  people,  *  ore  1S  aiso 

Ub^Snd“SZ4S^^ ft'fj Si?' ^r1 tt< *■«»' “ftoAn.mc^Clvil 

eat&c  service  provider's  network.*  W  ei^orcemest  ^as  caite  blaache  access  to  the 

•’'mates,  J»lSy  sSmotSS  SSSytohoMa'hS*  *“  ,t!Hllion  ofR'publiam 

Opponent «d  auntie* 


some  fear. 


searches. 


by  a  court  am  wfaat  we  intem^L"  ^  “  cos^ 1081 me  ««*  communications  author^ 

?''  '  ...... 


officials  said. 
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rulel^  h  *»t  necessary:  They  say  they  abide  by  the 
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wouldrefirse.  ^  *****  CompJied  Wltb  001111  orders  to  *““«B  Carnivore,  one  major  provider  said  it 

^5  J25B^S.  af '££ <* 

customers,  we  would  take  this  to  the  Supreme  Kt"  ^  °Merto  vloIale  pnvacy  of  all  our 

A^onties  say  that  more  criminals,  especially  those  involved  in  ehiM  nnra„™.  u 
increasingly  using  the  Internet  and  e-mail  to  commit  SS  Md  P°raograph>' md  ***•  are 


—  +  ***  Vli 

tSM<>*date  intelligence. 


authorities  said.  FBI  officials  SKSSlTr  T  **  **  18  months  ago, 

the  system  has  been  used  fewer  than  25  times.  ^  miation  about  Carnivore-related  cases  but  said 

FBI  officials  said  the  "unfortunate*1  choice  of  a  •  * 

6  013  0ame  emer®ed  dmmB  mtemal  discussions  ofthe  program. 
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Statement  for  the  Record  of 
Donald  M.  Kerr,  Assistant  Director 
Laboratory  Division 
Federal  Bureau  of  Investigation 

Internet  dD  t  j  on 

Before  the 

United  States  House  of  Representatives 
The  Committee  on  tee  Judiciary 
Subcommittee  on  tee  Constitution 
Washington,  D.C. 


Good  afternoon,  Mr.  Chairman,  and  Members  of  the  Subcommittee  i  am  w 

tee  FeSEanin  SS  ^emtLand  data  'o^ception  capabilities  developed  by 
oe  Federal  Bureau  of  Iftvgs&gatoon*  The  use  of  computers  and  the  tn temef  k 

cries’ ‘S h6C!  bLexpfftat'Qn  0{  cornputers>  networks,  and  data  bases  to  commit 9 

SeCfity* afld  Ppvac!r 0(  other^  Criminafs  use 
u  h5  P^nography  to  each  other  using  anonymous,  encrypted 

customer'^1»SartrtlkerS  bre!,k  mt°  ffnanc*af  service  companies  systems  and  steal 
inetvnanl- appresses  nnd  credit  card  information;  criminals  use  the  Internet's 
inexpensive  and  easy  communications  to  commit  large  scale  fraud  on  victims* ail  over 

deterrinn  domkersptan  tpeir  strikes  using  the  Internet.  Investigating  and 

wrongdoing  requires  toots  and  techniques  designed  fo  work  with  new 
S^«Sw°KP,U  ers  and  netv^*  technologies.  The  systems  employed  musSlke  a 
^  COfflPeiin8  Berests-  the  privacy  inteS  of  * 
telecommunications  users,  tee  business  Interest  of  service  providers  and  th*  dnh/nf 

ErS £WS't0  f°tect  P061*0  1  wouId  ftke  to  discuss  how  tee  Fb/ 

is  meeting  this  challenge  in  the  area  ot  electronic  mail  interception. 

cweXspSaf^h°P^JiTaf- StreetJourrff  published  an  article  entitled  "FBI's  system  to 
*  u  fstsBS  privacy,  l60ai  issues/  This  storv  was 

gfSffi  «  ""’ter  ot  simitar  reports  m  tbe  omss  and ■ 
ft.  *Stem  38  s0f1?6!^1B  ominous  ans  raising  concerns  about  tbe  possibHItv  of 

Tif  I80' n  ,s  att^f  important  as  technology,  and  partioularfy 

ouarantSSt?*^^0^’  *  C0!?t!n“es  to  ««&•  teat  the  pubifcbe 
Sdvemm!n,{  &  Irving  tee  statutory  and  constitutional 
P^®^s  th«y  demand,  ft  is  also  very  important  teat  these  discussions  be 

B^cC  uffiSSS  *«*  concerning  this  issued 

Omnte  Coma  Control  and  Sate  Streets  Act  of  1968  (as  wSSiSTy 
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^des  D evdcped  by  FBI 

»W«m£S«  «• wTsEhll!  Elec"wils  c“™’»'^tl<!ns  Privacy  Act  of 
exception  ofarareiv  !od®^!  Sovemment  interceptions,  with  the 

SSSKSA  uSffJiSS?1  m  °r* or  *»«*£ mSSv 

communltK 

I ™||ggin ^honrsafter  the surSliSSl^PP  CabC>n ^ SUCh 0rd9r  is 

Fftrfftraf 


t'ts  privacy  of  intetcepted  cutsets  anri  wihtLtlused  1y*«.iousli'‘ with  deference  to 

**"'*  -  •  *P’  ••;  <  y**i  V^.^-Sj'-'CV-^*'  *',  '  •  .  '  '  •"' 

tKP^JseauJhSrS^S^mSJS  arf SSh°  ^  Sff raf  ^Uft Un,ike 

appiicetto^and  orders,  instead,  the  applications  am 


°y  roe  umm  states  Attorneys  office  i 

s?  e  ssrssS! 

otherwise  subject  to  interception*  under  the' tewS^^nrS^^00®  °0t 
non«i  communications  of  the  subjects  o 

T  MMl  A*  t»  M' 


titoru 

rr"*",<» ;wwwwi,  me  judge  is  obligated  bvlawto 

Interception  order*  and  oth^oartie^s  *  «*  en$ure  *"at  *»  subject  of  the 


«r  inspection. 


FBI  ftwi  Room- 


f* 


r  -f''  '•'  •%" 


.•  '  (,  •#-•;.  7X  ^;''  •  ,  :  -  ..  -.;  *  v^i.  v  ... 

4Efe$l  Hl  m*  Pfifson  who  vw  a'  part  to  an  intert»os«rf 

against  whom  an  Interception  was  directed  maJir>™  ^  orwasa 


orterception  was  insuffictentonits  face  or  ^Proving  the 

Sj«B£S^^  was  001  in  conformance 


m  person  whose  communfcaions  am  imLwf  ik  ?^?r8* a  or  both*  fn  addition, 

:„.  S5gS‘^g°" «rr- 

P a9»iRSt  the  person  or  entity  engaged  in  ft©  violation.- 

Sl^m3SSSr2l5^oS)^SiSlMS*an?TO"WUaSenCy 

SssxsBr^sisur8 

toSnlnSS toSSSmS^feillSf Si f  Pf’6'' P®”1 S,BI1 

Person  is  according  the  person  whose  land,ord>  custodian,  or 

practice,  judges  may  sign  two  ordeS  weSSSSS  bf inSefcepted in 
agency  to  conduct  the  electronic  surveillance  «nd^I!?n% thtiaw  enforcement 
otow;  directed  to  the  service  provider,  s^cifying  forSSetn  SJ8**1,  af*istance 

el»)  isfotWiMsnfSa5SSiwSTiySyte«ss2rdl?l°l,'e,S  (otan^"e 

SSSSSSS^^ 

among  others,  that  service  proKteS  teteS^' !*is  forth{s 


product,  but,  in  many  cases,  serKSja  *  Eg*? ? f  f e  fina!  W*wpfen 
^Srceptot?SCeSSar^  *°  a^W  ager^^to  con^jctthe  ^ 

lucres  to  issue’  the  to  seek,  and  for  -  ' 

S^SaST'  Tre  “”&w 

sr are-  *• te-  *. 

aeatog  communications.  For  exampte^ntemef u^i^f  fscdm,nation  than  older 
messagtng  services,  like  E-mail  tn  «v»m.  iuS*W8^.ft^UiK’t^  088  otectronfc 
reminiscent  of  a  telephone  calJmly^ESe'S^  «  a  manner 

often  the  targets  of  court  oSdSeroeiS  Such  m6ssaSe$  am 

wide  web,  which  looks  morekkenrinlS^ U  ais0  US6  ^rvfces,  like  the  world 
internet  services,  like  sKtog  STS  Sfm8a^  *«"* 

ng  Vfdso' hav®  more  <"  common  with  broadcast  media 
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°0s^Dcy^podi5,'i%i  ^ 


s,  ^!.!^5®rnmtJ,"«a«c 


gov/prfcssrm/^ 
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increasinQly  incfo^  H  others,  very  diffm ft.  Court 


«**  Si-  1 W  °°U,t  ”**  **  * *»  court  o^^mnteZmn 

^sJSffg £255Su2i^^  T^e problem  of 

this  is  exactly  what  Carnivore  does  ffdis  nqt  «2S5  a  compfex  0f1e-  However, 

message  and  collect  those  that  contain  S??I  arcf)  *rou8h  the  contents  of  everv 

SS^f*9*8  baS9d  on  cHteriaexpSAe%Shf^n‘^m^  °r  “dfU9S-'  ft 

fho^9eSstraf!sm,tt8d  t0  or  from  a  particular  acentmr  Z^IZ  C»Uft  order* for  example, 
the  device  is  placed  at  some  point  on  the n5S2  f  or  from  a  Part'cu!ar  user  if 
messages  as  set  out  in  the  court  oSer  it  SjSSJS*  '  iannot  dfs^mfnate 
unrecorded.  oraer- 11  SinW  lets  all  such  messages  pass  by 


nX’  r  capaDlf,tiGS  which  allow  them  to  c»T »  ^  the 

*i«-»SySSK™1S«Sa7i mV° 

®!ses,  time  abilities  are  satisfactory  andSowS  Sed  user  accounts,  in  such 
J* 2J"*» 10  ®**  fSPs  do  n2  have  such  SSSS&C8  w,h  a  court  or9®r- 

complies^  the  court  order.  Ateof  many  court  onte!^  ™essa9es  >n  a  fashion  that 

ffi  used  in  practice 

and  **"»  « is  needed  te^iJSSS^^  **»<&  for  use 
FBI  Uboratory  in  Quantlco  until  it  fe  ISk^Z^St  d6V  Ce  is  Stained  at  the 

expiration  of^^order  th«f !wlf  single  case  or  court  order,  and  aftmwards^?innn 
w  me  order,  the  device  is  removed  and  returned  to  qSSST**  W  -', 


»■  \  wia 

i»V5ffl^SSSK^ 

ontoSSKS'  T°  date'  Rivera  has,  to 
^f  fSPe  technical  personnel.  S?emeUs  f  distance  from 

environment  in  which  to  conduct  suTf  f '« ®  hi8h^?mPtex  and  heterogeneous 
^6  technical  knowledge  of  the  iqp  *  «*.£,  f  can  assure  you  that  withr^ft 

instances  Smpo *  ««»  be  very  dllB.SS^ 


i^ogramOT  a  normal  personal  isom  *  w  w«w?  funsasan  - 
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to  Th*  FBI  also  depends  uj 


Anott^  pnmaty  consideration  for  using  me  Carnivore  system  is  data  integrity.  As  you 
know.  Rate  901  of  the  Federal  Rules  of  Evidence  requires  that  authentication  of 
i  c2ff  as  a  Pfecondtoon  tor  admissibility.  The  use  of  ihs  Carnivore  system  bv 
818  FBI  to  intercept  and  store  communications  provides  for  an  undisturbed  chain  of 
custody  by  proving  a  witness  who  can  testify  to  the  retrieval  of  the  evidence  and  the 
process  by  which  it  was  recorded.  Performance  is  another  key  reason  for  preferring 
this  system  to  commercial  sniffers.  Unlike  commercial  software  sniffers,  Carnivore  is 
designed  to  intercept  and  record  the  selected  communications  comprehensively 
without 'dropped  packets,* 

tn  conclusion,  i  would  tike  to  say  that  over  the  last  five  years  or  more,  we  have 

2*£?1  'SPff  stea^  9fowth  to  instances  of  computer-related  crimes, 
mdu«ng  tradition^  cdmes  and  terrorist  activities  which  have  been  planned  or  canted 

Glit.  Ifl  ftarf  this.  JnfawrtA*  ^  _ _ .  .  ■  .  w 


tn  fWMik,  (  uepenoam  upon  OUI 

to  tewfuily  coliect  vital  evidence  of  wrongdoing.  As  the  Internet  becomes  more 

Comdex,  so  do  the  challenges  placed  on  us  to  keep  pace.  We  could  not  do  so  without 
me  continued  cooperation  of  our  industry  partners  and  Innovations  such  as  the 
Carnivore  software.  I  want  to  stress  that  the  FBI  does  not  conduct  interceptions,  install 

and  operate  pen  registers,  or  use  trap  &  trace  devices,  without  lawful  authorization 
irom  a  court, 

l!fii2rard  t0  WOrkins  with  me  Subcommittee  staff  to  provide  more  information  and 
welcome  your  suggestions  on  this  important  issue.  I  will  be  happy  to  answer  any 
Questions  that  you  may  have.  Thank  you,  * 
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Statement  for  the  Record  of 
Donald  M.  Ken- 
Assistant  Director 

€-.•  . .  .  Federal  Bureau  of  Investigation 

C  Jp—  Before  the 

i  United  States  House  of  Representatives 

<  The  Committee  on  the  Judiciary 

Subcommittee  on  foe  Constitution 
a  ^  . .  »  Washington,  D.C. 

7/24/2000  - 

''  Good  afternoon,  Mr,  Chairman,  and  Members  of  the  Subcommittee.  I  am  grateful  for  this 
opportunity  to  discuss  foe  Internet  and  data  interception  capabilities  developed  by  the  Federal 
Bureau  of  Investigation,  The  use  of  computers  and  foe  Internet  is  growing  rapidly,  paralleled  by 
exploitation  of  computers,  networks,  and  data  bases  to  commit  crimes  and  to  harm  foe  safety, 
security,  and  privacy  of  others.  Criminals  use  computers  to  send  child  pornography  to  each  other 
using  anonymous,  encrypted  communications;  hackers  break  into  financial  service  companies 
systems  and  steal  customer  home  addresses  and  credit  card  information;  criminals  use  foe 
Internet’s  inexpensive  and  easy  communications  to  commit  large  scale  fraud  on  victims  all  over 
foe  world;  and  terrorist  bombers  plan  their  strikes  using  foe  Internet.  Investigating  and  deterring 
such  wrongdoing  requires  tools  and  techniques  designed  to  work  with  new  evolving  computers  and 
network  technologies.  The  systems  employed  must  strike  a  reasonable  balance  between  competing 
interests  -  foe  privacy'  interests  of  telecommunications  users,  foe  business  interest  pf  service 
providers,  and  foe  duty  of  go  vernment  in  vestigators  to  protect  public  safety  .  { would  l  ike  to 
discuss  how  foe  FBI  is  meeting  this  challenge  in  foe  area  of  electronic  mail  interception. 
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Two  weeks  ago,  the  Wall  Street  Journal  published  an  article  entitled  "FBI's  system  to  covertly 
search  E-mail  raises  privacy,  legal  issues."  This  story  was  immediately  followed  by  a  number  of 
^  similar  reports  in  the  press  and  other  media  depicting  our  Carnivore  system  as  something  ominous 

i >  '  .-O'  y. .  ...  .. 

and  raising  concerns  about  the  possibility  of  its  potential  to  snoop,  without  a  court  order,  into  the 
private.  E-mails  of  American  citizens,  I  think  that  it  is  important  that  this  topic  be  discussed 

;  .  ‘  ■;*  *  •  !f  ■  ■■  : 

openly-and  in  fact  this  was  the  reason  we  choose  to  share  information  about  this  capability  with 

*  ^ 

industry  experts  several  weeks  ago.  It  is  critically  important  as  technology,  and  particularly 
communications  technology,  a  continues  to  evol  ve  rapidly,  that  the  public  be  guaranteed  that  their 
government  is  observing  the  statutory  and  constitutional  protections  which  they  demand.  It  is  also 
very’  important  that  these  discussions  be  placed  into  their  proper  context  and  that  the  relevant  facts 
concerning  this  issue  are  made  clear.  I  welcome  this  opportunity1  to  stress  that  our  intercept 
capabilities  are  used  only  after  court  approval  and  that  they  am  directed  at  the  most  egregious 
violations  of  national  security'  and  public  safety. 

The  FBI  performs  interceptions  of  criminal  wire  and  electronic  communications,  including  Internet 
communi  cations,  under  authorities  derived  from  Title  IH  of  the  Omnibus  Crime  Control  and  Safe 
Streets  Act  of  1968  (as  amended),  commonly  referred  to  as  "Title  111",  and  portions  of  the 
Electronic  Communications  Privacy  Act  of  1 986  (as  amended),  or  "ECPA".  Such  federal 
government  interceptions,  with  the  exception  of  a  rarely  used  "emergency  **  authority  or  in  cases 
involving  the  consent  of  a  participant  in  the  communication,  am  conducted  pursuant  to  court 
orders.  Under  emergency  provisions,  the  Attorney  General,  the  Deputy  or  the  Associate  Attorney 
General  may ,  if  authorized,  initiate  electronic  surveillance  of  wire  or  electronic  communications 
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w^wut  a  court  order,  but  only  if  an  application  for  such  order  is  made  within  48  hours  after  the 
surveillance  is  initiated. 


Federal  surveillance  laws  apply  the  Fourth  Amendment's  dictates  concerning  reasonable  searches 
andseizures ,  and  include  a  number  of  additional  provisions  which  ensure  that  this  investigative 
technique  is  used  judiciously,  with  deference  to  the  privacy  of  intercepted  subjects  mid  with 
deference  to  the  privacy  of  those  who  are  not  the  subject  of  the  court  order. 


For  example,  unlike  search  warrants  for  physically  searching  a  house,  under  Title  HI,  applications 
for  interception  of  wire  and  electronic  communications  require  the  authorization  of  a  high-level 
Department  of  Justice  (DOJ)  official  before  the  local  United  State  Attorneys  offices  can  make  an 
application  to  a  federal  court.  Unlike  typical  search  warrants,  federal  magistrates  are  not 
authorized  to  approve  such  applications  and  orders,  instead,  the  applications  arc  veiwed  by  federal 

district  court  judges.  Further,  interception  of  communications  is  limited  to  certain  specified  federal 
felony  offenses. 


Applications  for  electronic  surveillance  must  demonstrate  probable  cause  and  state  with 
particularity  and  specificity:  the  offenses  being  committed,  the  telecommunications  facility  or 
place  from  which  the  subject’s  communications  are  to  be  intercepted,  a  description  of  the  type  of 
conversations  to  be  intercepted,  and  die  iden  tities  of  the  persons  committing  the  offenses  and 

anticipated  to  be  intercepted.  Thus,  criminal  electronic  surveillance  law's  focus  on  gathering  hard 
evideace-not  intelligence. 
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Wdicatc  that  other  normal  investigative  techniques  have  been  tried  and  failed  to 
gather  evidence  of  crime,  or  will  not  work,  or  are  too  dangerous,  and  must  include  information 

.  -  “SS??  ^°T  d>Smnic  survemanc«  regarding  die  subject  or  facility  in  question.  Court 

30  d^s,  with  extensions  possible,  and  must  terminate  sooner  if  the 

objectives  are  met  Judges  may,  and  usually  do,  require  periodic  reports  to  the  court,  typically 

,  evety7t0  10  ^vising  ^ it  ofthe  progress  of  the  interception  effort.  This  assures  close  mid 

on-i 


?' s  office  handling 

•  ttle  C3Se  md  frec*uent!'v  b>' the  25  Interceptions  are  required  to  be  conducted  in  such  a 
way  as  to  ''minimize  the  interception  of  communications  not  otherwise  subject  to  interception" 

under  the  law,  such  as  unrelated,  irrelevant,  and  non-criminal  communications  ofthe  subjects  or 
others  not  named  in  the  application. 

To  ensure  the  evidentiary  integrity  of  intercepted  communications  they  must  be  recorded,  if 
possible,  on  magnetic  tape  or  other  devices,  so  as  to  protect  the  recording  from  editing  or  other 
alterations.  Immediately  upon  the  expiration  ofthe  interception  period,  these  recordings  must  be 
presented  to  the  federal  district  court  judge  and  sealed  under  his  or  her  directions.  The  presence  of 
the  seal  is  a  prerequisite  for  their  use  or  disclosure,  or  for  the  introduction  of  evidence  deri  ved  from 
the  tapes.  Applications  and  orders  signed  by  the  judge  are  also  to  be  sealed  by  the  judge. 

Within  a  reasonable  period  of  time  after  the  termination  ofthe  intercept  order,  including  extension, 
the  judge  is  obligated  by  law  to  ensure  that  the  subject  of  the  interception  order,  and  other  parties 
as  are  deemed  appropriate,  are  furnished  an  inventory,  that  includes  notice  ofthe  order  the  dates 
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during  which  the  interceptions  were  carried  out,  and  whetehr  or  not  the  communication  were 
intercepted.  Upon  motion,  the  jusge  may  also  direct  that  portion  of  the  contents  of  the  intercepted 
communication  be  made  available  to  affected  person  for  their  inspection. 

Under  Title  HI,  any  person  who  was  a  part  to  an  intercepted  communication  or  was  a  party  against 
whom  an  interception  was  directed  may  in  any  trial,  hearing,  or  other  proceeding  move  to  suppress 
the  contents  of  any  intercepted  communication  or  any  e  vidence  derived  therefrom  if  there  are 
grounds  demonstrating  that  the  communication  was  not  lawfully  intercepted,  the  order  authorizing 
or  approving  tire  interception  was  insufficient  on  its  face  or  the  interception  was  not  in 
conformance  with  the  order. 

The  illegal,  unauthorized  conduct  of  electronic  surveillance  is  a  federal  criminal  offense 

+ 

punishable  by  imprisonment  for  up  to  five  years,  a  fine,  or  both.  In  addition,  any  person  whose 
communications  are  unlawfully  intercepted,  disclosed,  or  used,  may  recover  in  a  civil  action 
damages,  including  punitive  damages,  as  well  as  attorney’s  fees  and  other  costs  against  the  person 
or  entity'  engaged  in  the  violation. 

The  technical  assistance  of  service  providers  in  helping  a  law  enforcement  agency  execute  an 
electronic  surveillance  order  is  always  important,  and  in  many  cases  it  is  absolutely  This 

is  increasingly  the  case  with  the  advent  of  advanced  communication  services  and  networks  such  as 
the  Internet  Title  III  mandates  service  provider  assistance  incidental  to  law  enforcement’s 
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execution  of  electronic  surveillance  orders  by  specifying  that  a  court  order  authorizing  the 
interception  of  communication  shall  upon  the  request  of  the  applicant,  direct  that  a 
telecommunications  “service  provider,  landlord,  custodian,  or  other  person  shall  furnish  the 

V  .  +*■ 

applicant  forthwith  all  information,  facilities,  and  technical  assistance  necessary  to  accomplish  the 
interception  unobtrusively  and  with  a  minimum  of  interference  with  the  services  that  such  service 
provider,  landlord,  custodian,  or  person  is  according  the  person  whose  communications  are  to  be 
intercepted.  In  practice,  judges  may  sign  two  orders:  one  order  authorizing  the  law  enforcement 
agency  to  conduct  the  electronic  surveillance,  and  a  second,  abbreviated,  assistance  order  directed 
to  the  service  provider,  specifying,  for  example,  in  the  case  of  E-mail,  the  E-mail  account  name  of 
the  subject  that  is  the  object  of  the  order  and  directing  the  provision  of  necessary'  assistance. 

Service  providers  and  their  personnel  are  also  subject  to  the  electronic  surveillance  laws,  meaning 
that  unauthorized  electronic  surveillance  of  their  customers  (or  anyone  else)  is  forbidden,  and 
criminal  and  civil  liability  may  be  assessed  for  violations.  Not  only  are  unauthorized  interceptions 
proscribed,  but  so  also  is  the  use  or  disclosure  of  the  contents  of  communications  that  have  been 
illegally  intercepted.  It  is  for  this  reason,  among  others,  that  service  providers  typically  take  great 
care  in  providing  assistance  to  law  enforcement  in  carrying  out  electronic  surveillance  pursuant  to 
court  order.  In  some  instances,  service  providers  opt  to  provide  “full”  service,  essentially  carrying 
out  the  interception  for  law  enforcement  mid  providing  the  final  interception  product,  but,  in  many 
cases,  service  providers  are  inclined  only  to  provide  the  level  of  assistance  necessary  to  allow  the 
law  enforcement  agency  to  conduct  the  interception. 

6 
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fit  recent  years,  it  has  become  increasingly  common  for  the  FBI  to  seek,  and  forjudges  to  issue, 

orders  for  Title  111  interceptions  which  are  much  more  detailed  than  older  orders  which  were 

directed  against  “plain  old  telephone  services.”  These  detailed  order,  in  order  to  be  successfully 
-c •  ,  .-.a  . ,  ..  ...  .  •  ■  ■ 

implemented,  require  more  sophisticated  techniques  to  ensure  that  only  messages  for  which  there 

■■  jv  ,  to  intercept  are,  In  fact,  intercepted.  The  increased  detail  in  court  orders. iv; 

responds  to  two  facts. 


First,  the  complexity  of  modern  communications  networks,  like  the  Internet,  and  the  complexity  of 
modem  users’  communications  demand  better  discrimination  than  older  analog  communications. 
For  example,  Internet  users  frequently  use  electronic  messaging  services,  like  E-mail,  to 
communicate  with  other  individuals  in  a  manner  reminiscent  of  a  telephone  call,  only  with  text 
instead  of  voice.  Such  messages  are  often  the  targets  of  court  ordered  interception.  Users  also  use 
services,  like  the  world  wide  web,  which  looks  more  like  print  media  than  a  phone  call.  Similarly, 
some  Internet  services,  like  streaming  video,  have  more  in  common  with  broadcast  media  like 
television,  than  with  telephone  calls.  These  types  of  communications  are  less  commonly  the 
targets  of  an  interception  order. 

Second,  for  many  Internet  services,  users  share  communications  channels,  addresses,  etc.  These 
factors  make  the  interception  of  messages  for  which  law  enforcement  has  court  authorization,  to 
the  exclusion  of  all  others,  very  difficul  t  Court  orders,  therefore,  increasingly  include  detailed 
instructions  to  preclude  the  interception  of  communications  that  lie  outside  the  scope  of  the  order. 
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In  response  to  a  critical  need  for  tools  to  implement  complex  court  orders,  foe  FBI  developed  a 
number  of  capabilities  including  the  software  program  called  “Carnivore.”  Carnivore  is  a  very 
specialized  network  analyzer  or  “sniffer”  which  runs  as  an  application  program  on  a  normal 
personal  computer  under  fee  Microsoft  Windows  operating  system.  It  works  by  “sniffing”  the 
proper  portions  of  ne  twork  packets  and  copying  and  storing  only  those  packets  which  match  a 
finely  defined  filter  set  programmed  in  conformity  with  the  court  order.  This  filter  set  can  be 
extremely  complex,  and  this  provides  the  FBI  with  an  ability  to  collect  transmissions  which 
comply  with  pen  register  court  orders,  trap  &  trace  court  orders,  Title  III  interception  orders,  etc. 

it  is  important  to  distinguish  now  what  is  meant  by  “sniffing.”  The  problem  of  discriminating" 

between  users’  messages  on  the  Internet  is  a  complex  one.  However,  this  is  exactly  what 

Carnivore  does.  It  does  NOT  search  through  the  contents  of  evety  message  and  collect  those  that 

contain  certain  key  words  like  “bomb”  or  “drugs.”  It  selects  messages  based  on  criteria  expressly 

% 

set  out  in  the  court  order,  for  example,  messages  transmitted  to  or  from  a  particular  account  or  to  or 
from  a  particular  user.  If  the  device  is  placed  at  some  point  on  the  network  where  it  cannot 
discriminate  messages  as  set  out  in  the  court  order,  it  simply  lets  all  such  messages  pass  by 
unrecorded. 

One  might  ask,  ‘why  use  Carnivore  at  all?”  In  many  instances,  ISPs,  particularly  the  larger  ones, 
maintain  capabilities  which  allow  them  to  comply,  or  partially  comply  with  lawful  orders.  For 
example,  many  ISPs  have  the  capability  to  “clone”  or  intercept,  when  lawfully  ordered  to  do  so,  E- 
mai!  to  and  from  specified  user  accounts.  In  such  cases,  these  abilities  are  satisfactory  and  allow 

S 
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foil  compliance  with  a  court  order.  However,  tn  most  cases,  ISPs  do  not  have  such  capabilities  or 
cannot  employ  them  in  a  secure  maimer.  Also,  most  systems  devised  by  service  providers  or 
-  P^kased  “off  the  shelf’  lack  the  ability  to  properly  discriminate  between  messages  in  a  fashion 
that  complies  with  the  court  order.  Also,  many  court  orders  go  beyond  E-mail,  specifying  other 
protocols  to  be  intercepted  such  as  instant  messaging.  In  these  cases,  a  cloned  mailbox  is  not 
sufficient  to  comply  with  the  order  of  the  court. 

Now,  I  think  it  is  important  that  you  understand  how  Carnivore  is  used  in  practice.  First,  there  is 
the  issue  of  scale.  Carnivore  is  a  small-scale  device  intended  for  use  only  when  and  where  it  is 
needed.  In  fact,  each  Carnivore  device  is  maintained  at  tire  FBI  Laboratory  in  Quantico  until  it  is 
actually  needed  in  an  active  case.  It  is  then  deployed  to  satisfy  the  needs  of  a  single  case  or  court 
order,  and  afterwards,  upon  expiration  of  the  order,  the  device  is  removed  and  returned  to 
Quantico. 

The  second  issue  is  one  of  network  interference.  Carnivore  is  safe  to  operate  on  IP  networks.  It  is 
connected  as  a  passive  collection  device  and  does  not  have  any  ability  to  transmit  anything  onto  the 
network.  In  fact,  we  go  to  great  lengths  to  ensure  that  our  system  is  satisfactorily  isolated  from  the 
network  to  which  it  is  attached.  Also,  Carnivore  is  only  attached  to  the  network  after  consultation 
with,  and  with  the  agreement  of,  technical  personnel  from  the  ISP. 

This,  in  feet,  raises  the  third  issue  -  that  of  ISP  cooperation.  To  date,  Carnivore  has,  to  my 
knowledge,  never  been  installed  onto  an  ISP’s  network  without  assistance  from  the  ISP’s  technical 
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F-«L  The  Iotemet  is  a  highly  complex  and  heterogeneous  environment  in  which  to  conduct 

%  _  r  T  aSSWe  y0U  ltol  ,lK  teck™cal  knowledge  of  At  ISPs  peisormel, 

f  ,My  dlSiC“'t’  **  "  S0mc  *9"***-  for  law  enforcement  agencies  to 

*K"Smy  ^oontply  with  Restrict  tannage,  of  an  interception  orfer.  Tie  FBI 

depends  upon  tie  iSPpersomtei  to  imderstand  Ac  protocols  and  architecture  of  thor  particular 


networks. 


Another  primaty  consideratton  for  using  the  Carnivore  system  is  data  integrity.  As  you  know.  Rule 


901  of  the  Federal  Rules  of  Evidence 


requires  that  authentication  of  evidence  as  a  precondition  for 


its  admissibility.  The  use  of  the  Carnivore  system  by  the  FBI  to  intercept  tmd  store 
communications  provides  foran  undisturbed  chain  of  custody  by  prcvidlng  a  witness  who  can 
testify  to  the  retrieva,  of  the  evidence  and  die  process  by  which  it  was  recorded.  Performance  is 
another  key  reason  fo,  preferring  this  sysiem  to  commercial  snifferc.  Unlike  commercial  so(W 
aniffere.  Carnivore  is  designed  to  intorcept  and  record  the  selected  commonications 
comprehensively,  without  “dropped  packets.” 


m  conclusion,  I  wouid  like  to  say  that  over  the  las,  five  years  or  more,  we  have  witnessed  e 
"Udnuiug  ateady  grew*,  in  instonces  of  oomputor-re^  crime.  Unhiding  «,idnal  criotos  and 

teTOnS1  **''"“*  ^  ^ P'“ned  or  ranietl  <«.  “  Pan,  using  the  Internet  The  ability  of 
Ae  law  enforcement  community  to  effectivefy  investigate  andprevent  Aese  crimes  is,  Apart, 

dependent  upon  our  ability  to  lawfully  collect  vital  evidence  of  wrongdoing.  As  Ae  Internet 

Itceomes  more  complex,  so  do  Ae  challenges  placed  on  us  to  keep  pace.  W.  could  no.  do  so 
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if%  cool5aatio!!  of  our  Pastry  partners  and  innovations  such  as  the  Carnivore 

4^  1  want to  stress  &at  *»  FBr  does  w>t  conduct  interceptions,  install  and  operate  pen 

-I^^^usetraP&trac«  devices.  Without  lawfiil  authorization  from  a  court.  - 

\  %  •>'$*  V*  •••■  <  .  . 


I  to*  forward  to  working  with  lire  Subcommittee  staff  to  provide  more  information  and  welcome 
yonr  suggestions  on  this  important  issue.  1  will  be  happy  to  answer  any  questions  that  you  may 


haw.  Thank  you. 
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.  Fire  on  Hill-  * 

:<*.  -■  f 

fyloHsScavAin*  t  *  • 

gWangwi  hit  Su^f  Writer- 

PoMml  law  enforcement  ofiS* 
ciais  defended  *Cantlvorew-»^be 
rBFfi  controversial  Internet  wire- 
SFSten^Hhr&ugh  more  than 
two  acrimomoiis  hours  ©f  grifimg 
by  Bemooatic  and  Republican  taw- 
i  makers  yesterday,  painting  a  chill- 
tag  dndttre  of  ait  .Internet  that 
woaM  become  a  safe  haves  for 
'  and  terrorists  without  prop- 

■or  surveillance, 

v '  vQiminals  use  computers  to 
i  i^raograph y  to  each 

FBI  Assistant 
\  Director  Donald  hi  Kerr  told  the 


“Criminals  use  esmtptfteis  to  send 
ch3d  fKHroography  to  each  other," 
said  FBI  official  Donald  M*  K«r. 


f  House  Judidary  subcommittee  on 
t  the  Constitution,,  "Hadkers  break 
Pdnto  financial  service  companies' 
/  SF&cms  and  steal  tmstomcra'feome 
icredit^ard .  nrn^ 

■  bers^  criminals  use  the  Internet's. 

;  fucqpes^eind  easy  comrmmica- 
I  tkfcs  to  commit  largeocak  fraud 
*.  *  tfi  ©war  ^  wrid*  and 

r  Many of  the  lawmakers  seemed 
ts  cotmeriied  with  &e  actions 
iofthe  law  enforcement  oi&iais, 

* ^lae  potential  for  abuse  &r* ’is  fee-  ' 
ja^Kfods**  said  JR^  Spencer  B*. 
fJjjM pRAk.),  "What  you're  saying 
SsThrstus* %  >**'*  Vs-?  > 
^Carnivore  is  t  modified^vemon 
of «  commoaoetwo^^ 
program  known  as  a  ^packet  sniff- 


Civil  liberties  groups  and  inter¬ 
net  service  providers  say  the  sys¬ 
tem  raises  troubling  questions 
about  what  constitutes  a  reason- 
.able  search  and  sehsune  of  electron- 
ic  data.  In  - soling  out  potential 
criminal  conduct,  they  note,  the 
new  technology  also  could  scan  pri- 
,  yate  informafian  about  legal  activ¬ 
ities,  taking  in  vast  amounts  of  in¬ 
formation  from  innocent  people  as 

well  as  the  suspect 
Hie  critics  also  note  that  past 
experMtee  has  shown  that  law  ea- 
(forcemeat  has  overstepped  fe 
.'wiretap  authority  numerous  times 
jiathepasl 

| '  ^^  Stefohardt,  associate  <fe 
!  rector of  the  American  Cml  Uber- 

*ti«6  IT«W  i--*- _ i 


f^be  d?aity  to  quid#  cofiect 
j<st  the  ^to,  and  “from*  informs- 
t»«J  la  emaE  messages,  for  cx- 

«mpte,  *nd  apt  online  banking 
towatSdowsTbat.  gfa>s  Urw  m- 
rforaeramt  the  equivalent  of  the 
j  Wepbooe  woridV.-pers  register* 
«d  *ta»  «»d  fraoe*'aat»-the  o^. 
ifcMddestiaatioaof  sS  calls  relat- 
*  td  to  the subject;  \*  '  * 


a  wfrctap  capable  of  accessing  the 
easterns  of  the  convemthms  of  aS 
the  phone  company^  customers, 
wdb  the  ‘assurance*  that  the  FBI 
wSLtecord  only  conversations  of 
the  specified  target*  ■ 

Internet  service  pro- 


!-«^^K^5SShS  1 

i  publish  ;Monnaiioo  on  die  soft*  { 


..  waft  used  so  that  ISPs  can  be  sure 
I  that  it  does  what  fhe  agency  says. 
The  law  enforcement  officials, 
pledged  to  present  the  system  to  a 
neutral  third  party  for  review  bat 
said  they  cannot  release  so  much 
Information  about  the  system  that 
tt  will  become  a  target  for  evasion 
and  hacking. 

They  insisted  the  Carnivore  sys¬ 
tem  actually  provides  greater  prb 
vacy  than  previous  methods  of 
gathering  electronic  Information 
because  it  can  fine-tune  what  the 
machine  hands  over  to  isvestiga- 
tors,  - 

The  FBFs  Kerr  also  argued  that 
^fents  won't ‘*risk  thdr’ integrity, 
their  jobs  and  their  Mures*  by 
'  abusing  the  lam 

The  toughest  oue^oaiageame 
from  Reps.  JerMh  IS  <]> 
N.Y.)  «M  Ratert  L  Bair  Jr.  (R- 
Ga.),.two  eoagressmSi  randy  on 
tlie  same  ade  <rf  an  issue.  Hadter 
peppered  the  offidals  wife  a  series 
qtiestioas  that  rinddiseored  &e 
Point  that  Carnivore,  trader  the 
iat^  that  govern  pec-register  sur- 
wsSaooe,  could  be  used  vdtflhoot 
the  difficult  showiag  of  ‘pnAabte 
cause*  retptired  fc  a  tdtohoae 
wiretap.  . 

Barr,  cited  the  hrvestigatioa  of 
wisstng  White  House  email  and 
soornfufly  said  the  CSnton  admia- 
rstratfoo  asserts  ffiat  ^  don^t 
even  know  bow  to  keep  track  of  our 
owa  frmair  while  “asm  weaeea' 


wpuiJW  wo*  Kff  K6Q)“ 

u«  track  of  other  people's  mS 
After  the  hearing.  House  Major¬ 
ity  Leader  Richard  K.  Aratey  fe. 
®ued  a  statement  saying 
<rf  bath  parties  stowed  “strong 


.  IMSXIA  UmK,  mRv 

prbtectfoa  «g*M  im* 
wmtintednearidt  tad  ftrimre. 

.  these  coacems  are  id- 
'CandTOre 

Mouidbe  shutdown.* 
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y&3$§M>!Md  Panel  Debates  Carnivore 


Tt^  Httuts 

■  IqMiif  mf  Ttm  W*IX  sWr  *»  *N‘At 

*'  »f  ttureaa 

ZZ^lST  *fen<{wJ  its  Carnivore  to- 
term-Wftabnce  software  to  a  largely 
s*epmi  coagressiona!  oversight  panel, 
telling  lawmakers  that  the  electronic 
•  system  is  used  only  wiien 


*  >-v'  '*• 

(oWvPfii 


and  needed  to  protect 
citizens  from  criminate  and  terrorists* 

~  ™  *W*«  eritl es,  the  FBI  yesterday 
anaotmeed  a  new  tamper-proof  auditing 
mechanism  lor  Carnivore  that  it  said  will 
allow  federal  judges  and  others  to  review 
during  each  investigation  how  the  system 
Mf  moaftots  a  suspect's  e-roail.  And 
me  FBI  said  it  plans  to  show  Carnivore's 
y  workings  to  an  organization  that  it 
|}ll  select  to  prove  that  the  system  works 
m  as  described  by  the  government 
Members  of  the  House  Judiciary  Sub* 
®  mmittec  on  the  Constitution  pressed  FBI 
arid  Justice  Department  officials  yester¬ 
day  to  prove  that  only  e-tnail  and  other 
ipterBet  communications  from  criminals . 


"T1  w*»  ,«*w  use 

C^nmittee^told  them,  *You  can  un-  i 
oemaad  the  s5d$i$kuess"  of  some  people 


T  iyi  nereis  tromen-  ; 

dous^dant  yuo  agreer  added  Rep.  spes-  * 
«?r JMRs  CR^  Ala-h  -  .  ■• .. ; .  - 

e«ess  I.dsm’t  agree 
m  m  General  Oaunsel 

»ot.  Head 

^ttePBItafagafrgy  where  Gsnuvore  was 
develop dl,  added  that  the  ©csf twaxt's  hse  Is 
^wwts  totemai  reviews,  and 
tofflto*..wonidl  be  a  felony  *We  don't 

Isis^ftg'y  .***>  tima 

■  ^RitoOigym(D.rMi ctotoaM.  -If 
&**  everybody  wouldn't 
^y^^Q^gl^gsefrterafeastat- 
it  oiminal,  that  would  reduce  a 
§N  «r  efforts.*  But  after  Mr:  Kfcr  ofr 
e^toee*  that  Cared  we  captures 
it  Is  programmed  to 
Sjj**'  wOotyws replied*  mi 4sm*tkmw 


nntnwtiiwt  ~  '  -  rv  <■ 


mamtamx  ttert  mi  mic»rd  is  kept  of  any 
tmrelaled  messages  sent  by  imwcejft  cus¬ 
tomers  of  the  same  Internet  provider.  The 
FBI  has  used  the  system  IS  times  so  hir 
this  yean  m  six  criminal  cases  and  W 
ftationat-seeurify  investigations. 

Critics  complain  that,  since  hie  govern¬ 
ment  refuses  to  disclose  file  blueprints  for 
how  its  software  works,  there  is  little  as¬ 
surance  that  the  FBI  snooping  tent 
broader*  The  American  Civil  Liberties 
Onion's  associate  director,  Barry  Siein- 
hardL  testified  that  the  system  is  “roughly 
the  equivalent  to  a  wiretap  capable  of  ac* 
cessing  the  contents  of  the  conversations 
of  all  of  the  phone  company's  customers 
with  the  assurance  that  the  FBI  will  record 
only  conversations  of  the  specific  target/ 

The  panel  discussed  opening  Carni¬ 
vore's  blueprints  for  review,  which  the  FBI 
adamantly  opposes*  Even  then,  said  Hep* 
Jerrold  Nadler  OX,  Nl),  civilian  experts 
could  he  guaranteed  only  that  they  were 
looking  at  the  current  version  of*  Carni¬ 
vore*  which  is  oontimialiy  being  upgraded 
and  modified.  *It  'could  change  at  any 
time.  You  can't  trust  a  police  agency  for- 

ev^.he  said/<\;;  .  M  .  \ 

wde  4^11  allow  computer 

ways  to  defeat  the  system,  and  he  won- 

b&ehed  for  v&v$pw‘,'*vix*  wWi ih 


- - T"*“  v-gj-s-M.  j 

said*  /‘When  is  enough  enough?’* 
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ByWiiamGlaret 

^federal  law  enforcement  agents 
say  they  have  tised  the  contmver- 
*tal  Carmvnre  software  program 
to  track e-mail  of  suspects  25  times 

m  the  pasa:  two^years^ 

Bat  agents  have  never  used  the 
program  illegally  or  tracked  e- 
mail  they  were  not  authorised  to 
track  by  a  court  order,  FBI  Assis¬ 
tant  Director  Donald  Kerr  told  the 
House  Judiciary  subcommittee  on 
the  Oanstitodon  yesterday 

De^fte  the  restraint  the  FBI 
says  it  has  used,  privacy  rights  ad- 
[vocatcs^critidxea  law  enforcement 
using  Camivore  and 


said 
should  be 

of  law; 

^;«»^^^t.*ns'^econcOed.  v  * 
fP^S^lafaese^i^gQents  are  ad- , 
IfSr^^p^ximvQfe  should  be  shut  I 


Surveillance  tool 
employed  25  times 

But  lawmakers  expressed  con¬ 
cern  about  a  lack  of  checks  and 
balances  on  law  enforcement 
agents  using  Carnivore. 

’"Hie  potential  for  abuse  here  is 
enormous,”  said  Rep.  Spencer, 
Bachns,  Alabama  Republican. 

FBI  General  Counsel  Larry  Par- 
kinspn  said  Carnivore  is  a  little- 
used  tool.  When  it  is  used  Mr  Kerr 
said,  agents  follow  the  law 'care- 
folly,  and  if  they  are  caught  collect¬ 
ing  more 'data  than  allowed,  they 
can  be  imprisoned  up  to  five  years 
for  committing  a  federal  felony. 


enables  investigators  1 
|®r^rot'speciac  e-maTmes-  ! 

«a  *««r- 


U3£fi&i 

fted  cftech-savvy' 

:  Crimes  that  we 

:^^«y  d ay  bribe  35*3 


**Iu  the  past,  weVe  had  many 
agencies  go  beyond  the  scope  of 
their  authority,”  said  Rep,  John 
Ccmyers  Jr,,  Michigan  Democrat 
m*  Kerr  said  the  FBI  and  De- 
Justice  mil  seek  an 
independent  review  of  Carnivore 
this  mr  to  show  they  arent  rms- 
using  the  program. 

Lawmakers,  and,  privacy  rights 
^so  criticized  federal 
ofncisls  for  using  Carnivore  when 
Internet  service  providers  could 
just  as  easily  collect  informatom 
being  sought 

-  tP1?*  *5*^18  be  more  control 
in  the  hands  of  the  {Internet  ser- 
vice  providers]/'  said  Alan  David¬ 
son,  a  lawyer  with  the  District 
based  civil  liberties  group . Center 
for  Democracy  and  Technology, 

Mr,  Kerr  argued  that  few  of  the 
*>*5?*  10,000  ftitehiet 

service  providers  have  toe  means 
fo  sift  tareu^  e-mafl  traffic  and 
«Uect  them  for  law  en&reement. 

But  Robert  Com-Revere,  an  at- 
mniQr  who  represented  Atlanta- 
cased  Internet  service  provider 
Earthlink,  said  Earthlink  was 
gathering  e-raml  Information  at 


i  the  "very 


!*  *23? ly  with  a  com  order  and 
let  federal  officials  install  Carni¬ 


vore  on  its  computers, 

Tht  federal  government  was  up¬ 
set  that  Earthlink  was  capturing 
few  e-mail  messages,  Mr;  S 

fSSkZitn&^^ 

■  .  American  avilliberties  Union 
Assomate  Director  Barry  Stein- 
hardt  suggested  Carnivore's 
source  code  be  made  public.  The 
source  code  is  the  set  of  instruc- 
ttpns  a  programmer  writes,  and  it 
will  show  just  what  Carnivore  is 

capable  of  ** 


AS  conformation 

Act  request  with  the  FBI  to  get  the 
source  code.  ■■ 

Bren  though  they  had  a  raft  of 
questions  about  Canavore  and  its 
use,  lawmakers  yesterday  didn’t 
express  any  willingness  to  make 
immediate  changes  in  the  federal 
government's  authority  to  use  the 
surveillance  program. 

"We  should  be  sensitive  to  any 
potential  for  abuse  of  the  Cantf. 
vote  system.  Even  «  systenTde- 
rieied  with  the  best  of  intentions 
to  legally  carry  ot  *  essential  law 
enforcement  functions  may  be  a 
«tt»e  for  concern  if  its  use  is  not 

Chari ^T. -sa*<* 
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uaiksrul  Hkacfciwarttors  126  8 toad  Streep  t4$w  York,  My  ijQOOa-^GG 

"  *e*<?*2)S49K 

July  26, 2000 

John  Kelso Jr.  jCrt lv ^ 

Federal  Bureau  <jij  Investigation 
Chief,  FOI/PA  Section,  Km.  6296  JEH 
Washington,  D.C.  20535-0001 

Office  of  Public  Affa  irs 
"  United  S  tates  Department  of  Justice 
Room  1128 

950  Pennsylvania  Avenue  NW 
Washington  DC  20530-0001 

Attention: 

We  are  writing  pursuant  to  the  Freedom  of  Information  Act  (5  U.S  C  §  55?)  to  reouesi 
expedited  handling  of  our  July  14, 2000  request  for  ail  agency  records  (fedidt  Stem 

tape5rCC°rd^  n0(fiS’  d^~anda>  email,  computer  som^ 
thl  pm  i  ’ •  mimical  manuals,  technical  specifications,  or  any  other  materials)  held  by 
the  Federal  Buieau  of  Investigation  (FBI)  regarding  tlie  following: 

I.  The  computer  system,  software  or  device  known  as  ''Carnivore",  which  has  been 
or  is  currently  used  by  the  FBI  in  connection  with  trap  and  trace  and  pen  register 
orders  served  on  Internet  Sendee  Providers  or  in  connection  with.orden;  for  the 
m  lerception  of  the  content  of  electronic  communications  served  on  Internet 
service  Providers;  . . . 


r<SG»2»  S49  2SC8  fa*Cl2>549-; 


2.  Tire  computer  system,  software  or  device  known  as  "Omnivore",  which  has  been 
or  is  currently  used  by  the  FBI  in  connection  with  trap  and  trace  and  pen  register 
orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the 

int  erception  of  the  content  of  electronic  communications  served  on  In  ternet 
Service  Providers,  and 


a.  Tire  computer  system,  software  or  device  known  as  "EtberPeek"  which  has  wn 
or  is  currently  used  by  the  FBI  in  connection  with  trap  and  trace’and  pen  rogS 
orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the  ‘ 
interception  of  the  content  of  electronic  communications  served  on  Internet 
Service  Providers.  . 

We  seek  expedited  review  of  this  FOIA  request  because  this  information  relates  to 
impending  policy  decisions  to  which  informed  members  of  die  public  might  contribute. 


Stnass*ft  Pnzi&gn? 


Ira  GtesserSteculKeOwctor  K««»th  e.  ^  fvSj,tt, 
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'  •  access  to  these  materials  is  necessary  to  fbllv  inform  it,*.  *,»•  , 

'  maes su^oundine communications f  **  PubIlc s*o«t the 
^  8  commut?Ica{,°^  interception  and  related  technological  developments. 

Specifically,  wc  request  expedited  access  pursuant  to  28  C  F  R  16  Vdpi  VilY  wKir-n 

allows  such  processing  based  on  an  “urgency  to  inform  the  u  '  '  ^ 

aliened  Government  ;t  a  .  y  miorm  the  public  about  an  actual  or 

*'  information  “  As  evnlnmi^  ^  b^aferson  Primarily  engaged  in  disseminating 

S°yerament's  llse  of  Carnivore  is  a  matter 

to  protect 

-  has  been  so  strong  that  (W«  has  ISt  £?  Sf  PfI,C  f***  aboUt 

(See  Oversight  Hearin^m^Fo^th 7  “  *  *“*  one  hean«g  on  tins  subject 
fWmm  “  306th  Coim  A  e‘^ment hsues Raised the  FBI’s  ‘Carnivore’ 

*  SSS”':  (  Tt  (2000)-)  A  «*»*  Congressional  hearings  and  slew  of  press 

*^^5X2^  <s->  «$5r 

■>000  atAl  -nu  u  P?.7eFB1  Scrutiny  of  E-Mail,”  Washington  Post,  July  21 

“Fveinwr  Pt  i I?pper>  EatIng  Aw*y  a{  Privacy?”  Associated  Press  July  J2  oogo* 
Eyerng  High-Tech  Private  Eyes”  ABCNews.com,  July  14  2000-  ‘Sffr  * 
will  not  devour  privacy  ”  CNN  com  j«iV2i  n nnn\*  !,  FBI  says  Carnivore 

'  Mail  ‘CamivoraV’  PC  Wy ^  M“*"-  “™  »— * 

Moreovcr,  the  American  Civil  Liberties  Foundation  (ACLU  Foundation!  meets  the 

TO™"tiri7f  u  e  al‘0nal  S1C“riT  ?***  *•  DePartm®*  of  Defense,  where  a 
representative  of  the  news  media  is  defined  as  an  entity  dial  "gathers  information  of 

potential  interest  to  a  segment  of  the  public"  and  "uses  its  editorial  skills  to  turn  raw 

mr £.'  ACL,  ,‘f  ' ’T*'  "t  *M""  ,te  "•* 10  -  «*•»? «  F  Z 
briSn™  nohho  k01”'?  °!!  Ptl,sh's““vstel«- f'tqami  press  releases,  news 

public  Tts material  fcTwidetv Fi’it”1  °<,,er  11531002,5 11)21  are  disseminated  to  tiie 

not-for-profit  groups.  law  studSsU' 

mv.ucju.org  as  Wreli.  I  bus  the  organization  meets  the  pertinent  reeuhtfmr 
requirements  for  expedited  access.  P  ieyiUtory  . 

In  addition,  we  request  expedited  access  pursuant  to  28  C.F.R  16  SidKlUiv)  whirh 
allows  such  access  for  a  “matter  of  widecnrp-i/t  ,  -  ,  "  h  w  men 

there*  •vu»;Kie.  ,  •  V  OI  u  ,desPrca<1  and  exceptional  media  interest  in  which 

there  exist  possible  questions  about  the  government’s  integrity  which  affect  oubiir 

nfidenee.  Again,  the  recent  Congressional  hearfnos  as  well  as  the  storm  Af 
joverege  about  Carnivore  and  related  compur.pre^^  StptTvil^Z. 
wde^read  and  exceptional  media  few  in  .his  issue.  Moreover  '■ 

oi^zrra,s'‘,oub,s“to,he8~' 

We  have  enclosed  certification  (for  the  pmposes  of  expedited  access)  wi!h  this  leaer. 
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CERTIFICATION 


To  whom  it  may  concern: 

6C‘S  *"  ‘mc  a"d  C0TCC1 10  *•  ta<  °f  my  knowledge  and 


i ,  i  fie  American  Civil  Liberties  Foundation  {ACLU  Foundation)  meet*  ih*>  <-ru»  •  ,  *, 

out  a  National  Security  Archive  v  Dcoartmlt  nf nlr™.  i  ’  “  cntenon  ,,,d 

news  media  is  defined  Is  m  Mi  Jih7»SZf  w!iere  a  of  . the 

FoiSn  pSsSSSi0 1£7*-'  “J  R  “  a*  1387' 71,6  ACLU 

handbooks,  md  other  materials  that  nCWS  bnefiaSs>  to  fe»w 

, ,  *  ,u  ouier  matenais  that  are  disseminated  to  the  public  Its  material  ;c  j  « 

te  IS  y 

students  and  faculty  for  no  cost  or  for  a  nominal  fee  through  its  public  education 

epartment.  The  ACLU  Foundation  disseminates  information  through  publications 
available  on-line  at  wnv.adu.org  as  well.  publications 


Fhc  disclosure  of  information  r 
ilic  interest; 


n  regarding  the  following  computer  systems  is  In  the 


Ihe  computer  system,  software  or  device  known  as  "Carnivore’',  which  has  been 

*?*  ,h%m  “  ™rX°"  "•>«>  >“P «d  ««  aud 

interceofion  of!)  ^  1  1>!OV,dcrs  or  *»  connection  with  orders  for  the 

Se^e  Pmvidels0  *  ^  communications  served  on  Internet 


The  computer  system,  software  or  device  known  as  "Omnivore",  which  has  been 

ZZlZTjf  US? ?y  ih%m. m  COm,cc!ioil  with  traP  trace  and  pen  register 

orders  served  on  Internet  Service  Providers  or  in  connection  with  orders  for  the 

£T  °[CkCirQnk  ^  « Internet 


Hie  computer  system,  software  or  device  known  as  "EtherPeek”,  which  has  been 

BI *  connection  with  trap  and  trace  and  pen  Se" 
orders  served  on  Internet  Servi ce  Providers  or  in  connection  with  orders  for  the 

Pr^ddexs6  C°ntent  °f  eleCEr0n‘C  ^"^unications  served  on  Internet 

Records  regarding  Carnivore,  Omnivore  and  EtherPeek  are  likely  to  contribute 
significantly  to  foe  public  understanding  of  the  activities  of  the  government  ^ ACLU 

research  and  education  org alatioTwoldngl 
increase  citizen  participation  in  governance  issues.  The  ACLU  Foundation  k  mst-ino  u  ♦ 
^quest  speci  fically  for  the  public’s  enhanced  understanding  of  lawfully  authorized  § 
ire  appmg,  its  relationship  to  constitutional  guarantees  of  privacy  as  well  as  an 
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Web.  Uesc  «  **  ^  °f  fc  Worid  W 

SS" ite  wmm'  «  iszszs? 

iaierest  in  wHch^SS^So^?l“If '!!‘!f,rei‘d  “4  exc'Pl»nal  media 


Congress  ha*  I  ^  w  ?  ®  camTVOre  ««  grown  to  such  an  extent  that 

~3f*Tr*  il?ld  at  least  one  heann§  «a  tins  subject.  (See  Oversight  Hearing 

(*000)  )_  The  tremendous  amount  of  media  coverage  about  Carnivore  and  retard  S' 
computer  programs  also  provides  strong  evidence  of  the  **w«W  »  a  a  ted. 

m=dia  inter  i„  this  i  sL.  (See.  c  g  lota  Sti  "R  ™,?  ^"d  ““l®™' 

Scruttnv  nf  p  x#,;i «  nr  ,  ■  ,  ’ onn  J>cnwartz»  Republicans  Oppose  FBI 

??  Posl.  duly  21. 2000  al  Al;  D  Ian  Hopper,  •t=,^., 
A,vny  at  Privacy?  Associated  Press,  My  12, 2000;  “Eyeing  High-Ter*  hivte  fis  » 
ABCNews.com,  July  14  2000*  “FFil  smCo™;™  4-euu  mate  Byes, 

July  21 ,  2000'  Margaret  Johnston  4m  n°  l  n0t  devour  privacy,”  CNN.com, 
Jtli'  n ,  ’  onno\  r  ’  FBI  Dcmos  « ‘Carnivore*,8’  PC  World  com 

Ju*>  t 1  *  2000-> 1,1  Edition,  the  requested  materia!  mav  provide  J e!  ’ 

questions  regarding  the  eovmmmf’o  „»»-  ,  i  ide  aT1$wers  t0  senous 

liberties.  government  s  willingness  to  protect  individual  privacy  and  civil 


Barry  StcWmdl,  Esq. 

On  behalfof  the  ACLU  Foundation 


<? /  (/\> 


July  26, 2000 
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Diagnostic  Tool 


^%5sSiS^S^E^  Py^  telilfe-EBi,  Statement  for  the  .  " 
**  no«se  of  Representatives,  the  Committee  on  the  UidM*™  ^ ;  v 

»  ^j^y^^y:^^''''''''^^^' '  ;‘! '  '  ’v  '"’';r'  ' 

S^^pp^s&^ss^s0- 

anSivftfBsV  8  ^°romun*catons  to  plan  and  execute  their  criminal 

SaSSlSgeSnS  5 ^SlSKS^SSSbeKSto^u  *3?®*' *?^o^t«5SSSe» 

subject  to  being  discredited  or  imoeached  throM^S^^?!00® !ha,can  b® 


based  upon  a  defendant^  wo^  ^  5  °pp0rtumty  t0  **”*» factua!  ^ues 

D^artmem  of  dSSpO^oS  before ^K^fuSt^SerAnomevs  off  61 
Si  ShSSSSS  SSESffiJ^SojHi^f  with  federai  district  court  ju^or 

p  ion  of  communications  is  limited  to  certain  specified  federal  felony  offenses.  ’ 

22^  P^babie  cause  and  state  with 

or  place  from  which  theXbjecfs  commumSonsSote  imeSiSmUrf iCSt^ facMty 
the  types  of  conversations  to  be  interceoted  and  ih*  ne<C.t0e0, a  ^escr,PJi0n  of 

lam  focus  on  sphering  dm  evkte ra  -  n elWroniC  sttmlUatm, 

SSSTS“  SSSS,^  Siloes  *»  not  wort,  of am 
resanling  Bis  subject  or  facility*  qLstto  cSmSSSSSLtS^  "ve*TO8 
interceptions  must  terminate  LnS»  CoSSSm  SE^SS*?*  8nd 

w«y  of  is? mj5iSsiSM?Sinii^o^")  01 «» 

pe*n«ted,  «  justified,  for  up  to  a  period  of  30  days.  ™  application}  are 

the  eviction  of  more 

for  electronic  surveillance  as  the  evidence  cannot  hnJshf^Yt  ®fS8sJhere  *®  no  substitute 
investigative  techniQues  03  030,101  te  obtatnecf  trough  other  tradftionai 


5 S mainS‘l lwes88aiions 
CamiV“  tfattice^provides  the  F8.  wis,  a  -surjlcal  at***,  intern,*  and  cofcc.  the 
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.  "Stop  Carnivore 


Stop  Carnivore 

July  27, 2000 


,■  ■■'*■*■.■  Ai#:-  .•* 


Page  I  of  i 


JS R^Sf re,0f  Consref  sent  **  followln8  tett9r  to  Attorney  General 
Janet  Reno  asking  her  to  suspend  operation  of  the  Carnivore  internet  ” 

addressed6  S^tem  unti!  the  serious  privacy  issues  involved  have  been 


1 


Congress  of  tfte  Unto  &&** 

2Sfa$bmgtcf!(  2BC  20515 
July  27,  2000 


The  Honorable  Janet  Reno,  Attorney  General 
US  Department  of  Justice 
950  Pennsylvania  Avenue,  NW 
Washington,  DC  20530-0001 


Dear  Attorney  General  Reno, 


Carnivore,  it  has  been  reported,  enables  the  Federal  Government  to  scan  -ill  of  fh* 
Mffic  on  »  Internet  Service  Provider's  nelwotk.  Although  law 

", has  «*>»  FOB#.  Amendment 


communication? 

ta  (hcfivfy  r*  sec“V  of  the  Internet  am  essential  for  ■, 
is  not  reading  their  cmail,Tm“terhow  woSly  ftfoySdvf' ^ ts,wrmmt 

Carnivore  could  have  on  consume  confided  X  the htaSt wX^^tTsXpend 
any  activity  involving  the  development  or  use  of  Carnivore  until  the  Serious  nrivaev 
issues  involved  have  been  satisfactorily  answered.  ^  ^ 

Sincerely, 


httpy7freedom.house.gov/libra5yVtechnology/camletter. 


asp 
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iff  .  -V^'; 

i$:k:  -1  '  ' 
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.  .  .  Dick  Armey 

s."  Kevin  Brady 

ipif^.s-v  . ..; .... .... 3 
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Tom  Cobum 
Charles  H.  Taylor 
Dan  Miller 
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Wm*tosmO$x&  story  to  another  AQL  member?  Cfick  on  the  heart  at  the  top  of  this  wmfcw. 

FBI  Inferhet-wlretap  system  review 


WAStflNGTQN,  My  27  (Reuters}  -  U.S.  Attorney  General  Janet  Reno  described  on  Thursday  a  two-step  process  to  review  a 
new  FBI  Wemef-wiretap  system  called  Carnivore  that  has  raised  privacy  concerns. 

•  v"‘  ■ 

With  lawmakers  and  pn'vacy  advocates  concerned  the  system  allows  for  widespread  surveillance  of  e-mails,  Reno  said  the  first 
step  wall  be  for  a  group  of  academic  experts  to  conduct  a  detailed  review  of  the  computer  program's  source  code. 

* 

"Those  experts  will  report  their  fadings  to  a  pane!  of  interested  parties,  people  from  the  telecommunications  and  computer 
industries,  as  well  as  privacy  experts/  Reno  told  her  weekly  Justice  Department  news  briefing*..  *• 

very  anxious  to  get  this  review  under  way.  The  FBI  is  working  on  it,  and  representations  of  the  bureau  are  meeting  with 
privacy  advocates  and  representatives  of  the  telecommunications  and  computer  industry  to  pursue  it  and  to  develop  a  protocol  fo 
the  revfew/ she  said* 

The  system  allows  the  FBI  to  intercept  the  e-matis  of  a  criminal  suspect  among  the  Hood  of  other'data  passing  through  an 
Internet  sendee  provider* 

FBI  oidaSs  maintain  the  court-authorised  wiretaps  will  only  focus  on  criminal  suspects  who  are  targets  of  an  investigation.  But 
privacy  advocates  fear  the  system  may  cast  too  wide  a  net,  encompassing  private  information  about  legal  activities. 

Reno  said  the  two-step  process  was  worked  out  with  the  FBI,  and  that  she  wanted  the  review  to  be  done  "'as  soon  as  possible/ 


She  said  the  system  would  not  be  suspended  until  the  review  has  been  completed.  T  think  that  we  will  continue  to  make  sum 
that  it  is  implemented  carefully  and  there  is  no  abuse  in  its  use/ 

in  a  letter  to  Reno,  27  House  of  Representatives  Republicans  and  one  Democrat  expressed  ""strong  reservations*  about  the 
system  and  urged  Reno  to  halt  its  operation  "until  the  serious  privacy  issues  have  been  satisfactorily  answered/ 

The  lawmakers  added,  "‘People  should  feel  secure  that  the  federal  government  is- not  reading  their  e-mail,  no  matter  how  worthy 
the  objective/ 

Reno  stopped  short  of  agreeing  to  release  the  source  code.  The  American  Civil  liberties  Union  has  asked  for  it  to  be  made  public 
so  it  could  evaluate  the  software's  true  capabilities. 

14:06  07-27-00 


Copyright  2000  Reuters  limited.  Alt  rights  resermf.  Repuhftcation  or  redistribution  of  Reuters  content  inducing  byframhg  or  simitar  means,  /s’1' 
expressly  prohibited  vtithout  the  prior  written  cm sent  of  Reuters,  Reuters  shah  not  be  liable  for  any  errors  or  delays  in  the  content  or  for  any  actions 
taken  in  retirnm  Uweott  Ah  active  hyperlinks  have  been  mwted  by AOL 
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to  $mtf  this  story  to  another  AOL  member?  dick  m  the  heart  at  the  top  of  this  Wmfm 

^^^Addresses  E-mail  Surveillance  .• 

J^JAN  HOPPER 

'%  Thie  Associated  Press: 

!  - 

I  WASHINGTON  (AP)  *  A  move  is  under  way  in  Congress  to  increase  toe  bunfen  on  federal  law  enforcement  agencies  to  lustily 
k  monitoring  peopled  e-mail  messages  and  other  communications.  1 

!*  •’  #  '•  .....  •  '  ‘. 
j§  ReP-  8% Bar  confirmed  that  he  and  his  staff  are  at  work  on  a  bill  that  would  ran  in  the  FBI’s  new  "Carnivore*  surveillance 
|  system  and !  place  additional  restrictions  on  telephone  wiretaps  as  well. 

!£  '  ''%£  ■><  -••'■  •  ■  X-P'  ‘ 

I  Barr,  R-Ga,,  said  he  was  concerned  about  computer  eavesdropping  capability  before  attending  a  hearing  on  Capitol  Hill  earlier 
4  this  week,  and  he  said  he  "came  out  of  it  scared.* 

i  priva«y  advocates  and  computer  experts  caiied  Carnivore  a  "black  box*  in  testimony  Monday,  and  said  only  the  FBI  knows  whal 
v  tru*y  rfo5@s-  also  contended  toat  information  the  FBI  gets  from  the  device,  installed  at  a  suspects  Internet  service  provider, 
Is  for  more  than  what  could  be  gleaned  from  a  telephone  wiretap  and  statutes  governing  telephone  surveillance  are  being 
misused. 

In  a  telephone  "trap-and-iraee*  or  "pen  register*  wiretap,  authorities  can  get  a  fist  of  phone  calls  made  to  and  from  a  certain 
telephone  number.  The  usable  information  is  limited  to  the  10-digit  telephone  numbers  and  the  time  of  the  calf,  and  the  phone 
company,  when  given  a  court  order,  provides  the  information. 

Current  laws  and  judicial  precedent  say  that  toe  numbers  a  person  diais  are  not  private  communications,  and  therefore 
authorities  do  not  need  to  show  that  a  crime  has  been  committed. 

With  Carnivora,  toat  statute  is  being  extended  to  toe  Internet  world. 

The  details  of  Barr's  bill  aren't  clear  yet,  but  he  said  it  would  address  the  issue  of  translating  telephone  wiretap  law  to  the  Internet 
by  designing  strict  constraints  for  monitoring  toe  medium.  It  would  also  make  sure  that  evidence  gained  from  an  e-mail  tap  would 
not  yield  more  information  than  a  similar  court  order  for  a  telephone  tap.  f 

The  FBfs  new  surveillance  mechanism  sits  at  toe  subject's  ISP  and  scans  the  addressing  information  coming  from  or  going  to 
the  suspect's  computer.  This  can  reveal  for  more  information  than  a  simpfe  e-mail  address,  such  as  a  subject  line  describing  the 
contents  of  the  messaga 

"Capturing  Internet  origin  and  destination  address  instead  of  lumbers  dialed’  could  create  a  much  more  intrusive  form  of 
surveillance  that  is  not  clearly  supported  by  law,*  said  Alan  B.  Davidson,  staff  counsel  at  the  Center  for  Democracy  and 
Technology. 

For  authorities  to  be  able  to  request  e-mail  contents  they  must  show  probable  cause  and  obtain  a  search  warrant.  The  same  is 
tree  for  listening  in  on  a  telephone  call. 

Regarding  toe  inner  workings  of  Carnivore,  the  FBI  Is  resisting  a  Freedom  of  Information  Act  request  by  toe  American  Civil 
Liberties  Union  for  Carnivore^  computer  code,  but  said  It  witl  submit  to  an  externa!  review.  ' 

Smce  the  Carnivore  computer,  devoid  of  keyboard  and  mouse,  sits  at  the  suspect's  ISP  and  is  locked  down  from  any 
manipulation  from  non-FBI  personnel,  Internet  providers  have  bristled  at  the  idea  of  letting  it  sit  on  their  networks. 

Donald  M.  Kerr,  assistant  director  of  the  bureau's  laboratory  division,  said  in  an  interview  that  toe  FBI  would  love  to  have  the  ISP 
prowde  the  information  authorities  need,  but  toe  cost  and  technical  knowledge  can  be  prohibitive  for  small  Internet  companies. 

Peter  William  Sachs,  a  lawyer  and  president  of  ICONN,  a  small  Internet  provider  in  Connecticut,  sad  the  Job  could  be  done  with 

two  lines  of  computer  code,  and  called  it  a  "trivial*  task.  - 
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^mctHKmBeS,  not  satisfied  with  the  FBfb  explanation," 

SajS^.**1®  *  *®f >n  keeping  apace  of  the  changes  in  technology. 


monitor  abatis,  Kerr  said,  but  it  a!so  can  monitor  Web  browsing,  chat  rooms  and  ail  sorts  of  other 


"T"***  is3^fisJ®9um6nt  m  a!thou9h  C******  030  read  those  things,  ms  a  difference  between  "capability  and 

auoWBjMfibn,"  Kenr  saM/sr*-  .•  r  •>•-•.  ■  ,  ,  ...  .  -  ,.<  ^  .  . 

■  ' '’fe.;:':,  ...  •'  '■'■■'  '  -  ,  -  *  • 

vUr:  >'»iSr£  •£•'•>  7h,.!-  •*.->«•  v.v  •  .'  . ' ., 

People  seem  to  conjure  up  this  vision  that  FBI  personnel  are  unsupenased  and  unconstrained  in  the  use  of  these  tods  *  he 

the&e  afhorfSies  to  9°  oufside  the  sc°Pe  of  court  order  is  to  commit  a  federai  felony,  it’s,  to  me  not 
conoei^yhat  groups  of  our  employees  would  run  that  kind  of  risk  in  doing  their  job  *  " 

“  *****  **  c‘""i''”  ,h“  k“ps  teck  °,i,s  **  <**«***«■ •« •» •«  wi 

Barr  said  he  expects  resistance  from  other  legislators,  even  from  other  Republicans,  but  said  he  will  not  let  the  FBI  oo 
unchecked  '  w 

"They  want  to  just  go  out  and  rely  on  scaring  people  to  death,  that  if  they  don't  get  this  authority,  the  terrorists  wil!  take  over  the 
.  ,r  country,  and  say  WeVe  out  to  save  the  world,*  *  Barr  said. 
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*^P:CV^dy  Introduces  BiI1 10  Opdate .Wiretap' Law^*jS 
and  Stored  Internet  Communications  Would  Be  Covered *'; 

WASHINGTON,  D,C.  —  Rep.  Charles  T.  Canady  (R-FL)  Chairman  of  the  t  a-  • 

Subcommittee  on  the  Constitution,  today  introduced  the  Electron!**  r  >  ^0use  JucJlciar>' 

2000.  The  bill  would  update  the  federal  wiretw  laws  to  SS!  Communicattons  Privacy  Act  of 

communications,  as  well  as  provide  ?  ?  m”1  <md  stored  e,earonic 

addresses  Canadv  k  *  5>?Cia  re<*mrexnents  f°r  government  tracing  of  e-mail 

addresses.  Canady  is  joined  by  original  cosponsor  Rep.  Asa  Hutchinson  (R-AR). 

This  legislation  helps  move  our  federal  wi reran  laws  into  fh*  nttre  ,  ,,  ^ 

said.  “We  have  entered  a  new  a**.  with  tu  r  * P  *  in,° the  iist  Century,  Canady 
..  . Cl  uwrea  8  new  a£e  with  the  Internet,  and  we  need  a  new  w  tn  jl 

fhe  rapid  changes  in  technology.  While  this  legislation  does  act  answer  alHhe 

issues  raised  by  recent  technological  advances  it  does  nrovid.  r„  1  “*  dimc,1,< 

reforms  that  win  +u  ■  uces» 11  aoes  Provide  for  some  reasonable 

reiorms  that  will  protect  the  privacy  rights  of  Americans.” 

Earlier  this  week.  Rep.  Canady  chaired  a  Constitution  Subcommittee  hearing  a  j 

issues  raised  by  the  FBI’s  “Carnivore”  program  The  pm  ,w  a  \  T  g,  n  Fomh  Amendment 
isolate,  Intercept  and  collect  comm^icatkmTfhatare  and  developed  Carnivore  to  ‘ 

24ft  hearing  featured  witeS!r  t  ■  "*  subjecl  of  towflli »“«  orders.  The  July 

.  WItnesses  from  Jaw  enforcement,  civil  liberty  oroanizatmns  nrk,*™ 
organizations  and  representatives  from  the  business  community.  ^  P  y 

bill  SUMMARY 

“electronic  communications”  and  illegally  obtained  dwT “ lUcga1Iy  ?****&*  -  T  ' 
^hddselectroufeconui.nieaUo j 

ils requests  for  ordc^ffer  fee  d'iSosro'orSOTed  e°ISk"c '° pr0d?“  *nnu*1  nT>di»  regarding  'i 
j^^^h^^^riiscIosuK  requirements  the  federal  of  ^ 

**"*  tf  >  P“  or  wp  and  brace  device  is  used  ft  ideurify  „  e-mail  edtess  ^  ^ 
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government  must  first  demonstrate  to  a  court  that  “specific  and  articulable  facts  reasonably 
a  crime  has  been,  is  being,  or  will  be  committed,  and  information  likely  to  be  obtaine 
W§>  *  «ndu$e  [of  a  pen  register  or  trap  and  trace  device]  is  relevant  to  an  invesfigati. 


Fof  *  copy  of  Rep.  Canady’s  legislation  (7  pages)  please  call  Michelle  Knott  at  (202)  225~12S2> 
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SHBWte  ,***£&  *&'  ^$a§u*»tf^  * 

s  J0e;FBJ  insm  that  ^recently  'disposed 
<**?TUv&rs  Internet  surveillance  system  is  iaot 
a  y^'?p^ctrum  tinea  t  to  privacy.  Federal  oi> 


S  to hying to force a firehose^  ewt. 

s  ytot  JS  authorized,  whether  with  good '  W 
■  tions  or  eva,  is  powerful  JUw  enforcement  has 
:  .  done  it repeatedly  in  the  past,  undercutting  jo 
.  •  sorae-octeat  the  assurahces.that  it  won't  happen 
“  AadtheiimaemepwftrS 

;  ^mv^poss^  only  enhance?  the  pressure 

'-  '  :'Tha£V'%  factions  .«'  divergent  as:  ex> 

•  *j*®*^.^***i  &od  deeply  conservative  mem* 
i  .  texs  of  Congress,  dong  with  the  ACLU  and 
:•  S'®*  pidn  citizens,  fes  nervous  about  the 

; .  device.  Its  technical  ability  to  run  afoul  of  the 
i  Fourth -Amendment's ,  protections  against  un~' 

\  •  reasonable  searches  is  unmistakable 
/  ‘  .>What  this  Sap 'points  to-above  all  else  is 
.  that  ocmammkatKm  technology  has  far  out¬ 
paced  die  nation’s  wiretap  laws,  some  of  which 

toi  **£  early  ^  ^S»t*ay-  This  is  a 
problem  only  Congress, can  address.  To  its 
credit  and  that  of  the  administration,  some  at¬ 
tempts  am  in  progress.  - 

The  administration  has  asked  that  federal 
laws  oa  internet  communications  security  be 
upgraded  to  assure  that  they  match  the  kind  of 
judicial  and  administrative  restraint  that  al« 
t*8^  ^PR?P  }°  phoas  taps.  Sen.'  Patrick 
lea^r,  D-Vt,  has  written*  bread-based  In-  > 
t*met  pnvacgr  big,  and  Sea.  Onin  Han*.  R- 
XJtah,  has  introduced  another,  somewhat  nay- 

Sadr  attempts,  while  laudable,  will  notbe 
**o«wi»d  for  months,  perhaps  years.  Mtaa- 
witSe,  the  FBI  has  offered  to  let  an  indepen-  * 

SsSdtS?  ,^ter  <^a^*e^s 

wd®0me*but  Carnivore  wight  to  be  shutdown 

.  JJJj* 

^  entixdy  deprived  of  surveilkjtof^moues, 
wit  jmttwg  Carnivore  on  hold  wouldn't  do 
mat.  It  wwiid,  on  the  other  hand,  provide  at 
tost  some  assurance  to  innocent  parties  that 

Pn,?te,  ^ves  area*t  open  books.  That 
could  hardly  be  a  bad  thing 

.TOTAL  P.02- 

&  OC 


m^y  or  most  instances  these  rest  on  a  judge- 
si^d  surveillance  order  keyed  to  evidence  that 
a  $nous  crime  is  being  or  has  been  committed. 

|These  are  welcome  assurances.  But  for  the 
Orament,  that’s  all  they  are.  As  one  conservative 
ABbama  congressman  said  at  a  Monday  stib- 
^ttee  hiring,  *what  you’re 

,  0s.r,.,  * 

xXbMs  the  nub  of  the  probiein.  The  onu- 
nonsly,  named  Carnivore  is  so  encompassing,  w 
sophisticated,  so  tw-eakable  —  and  its  imier- 
workms  so  closely  guarded  —  that' it’s  almost, 
impossible  for  anyone  besides  its  operators  to 
know  what  it’s  really  examining  and  really  ig- 

This.differs  markedly  &om  tetajhbne  wire-'- 


■  jtinctioa  box  and  attached  comiectors 

to  terminals  for  that  phone  and  that  phone 
only.  In  some  instances,  only  incoming  and 
outgoing  phone  numbers  are  registered  In  oth¬ 
ers;  depending  oa  what  a  judge  thinks  is  aeees- 
sa^y,  actual  conversations  are  recorded. 

'  *.lQ  a  sens t,  comparable  service  cart  sti2  be 
owyered ts  enfwceiaeat  agencies  by  a  cus- 
wraer  s  Internet  service  provider.  It  is  reasona- 
Wy -assured  that  only  one  dfcnt’s  commuwea- 


Camwore  ts  dsffcreot.  If  da  service  pro* 
.wdtf  aCows  tt  to  be  installed,  the  Carnivore V 
4ef.-is  placed  direcdy  ia  the  path  of  the  com- 
•panys  «itire  Internet  data  lW.  The  filter  is 
sdgpored  to  uaailf”  only  w^iat  it  is  set  to  —  for 
jpe&tuptfc,  asoMang  Aud  outgoing  o-nistii  id- 
to^es  for  just  one  account  Or  it  can  probe 
moretto^f.But  everything  moves  through  it 

>dumf  itnik  a  .w^^vr.n  .  deals  to  reimies 
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kjsS*  D3?st  comforting  observation  we’ve 
s®  far  came  from  the  FBl's  Marcus 
a  <J?,c!oPcr  oftte  sys«m  Me  told  B» 
•Wall  Street  Journal  than  if  Carnivore  actually 
J*«re  told  to  nrad  everything  that  came  through, 
it  .would  bog  Introict  itzuic  down.  to  A  d^grtc 
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7 1  ?;'  TV  Hunger  of  iecth  warrants 

-  v  seeteig  ri&ensf  online  data  has 
soared  more  than  m&  dunng  the 
past  few  years,  a  USMtmt  *udy 

ShOWS." .;• 

The  findings.  based  on  an  ecamf* 
naoon  of  wanar&s  served  on  the 
W  Net  service  mwfcfer,  America 
Onaw,  surprised  federal  tewmak- 
er$  and  dvi!  libertarians  and 
•  prompted  calls  for  legal  reforms, 
j  Searches  for  the  Mine  data  tyja- 
callyinvolvecases  ms^fiwm  to* 
rsssment  and  child  ponwgr^tyto 
violent  crime  and  ted  and  are 
teed  at  discovering  lire  identity 
and  tradctog  the  activities  of  sub- 
i  scrfcere.  last  year,  AOLwas  served 
*3®  3w search  warrants,  up  from 
33  tn  J937. Hus  year,  stare  and  local 
investigators  have  served  191  war* 
rants  tratxtghjuly  17,  filings  show 


AOt  tod  ro  comment 
Mte^se^p«m*tearai 
wb  mat!  providers  to  the  USA 
*«w  experienced  a  dguStea:  is* 
oease  in  the  number  of  seariSi 
wanaras  and  subpoenas*  said  An-1 
drew  Grosso,  an  attorney  who  sps- 
cMas  in  computer  Saw  -  ■ 

Gongretenal  leaders  informed 
of tto  fimfings  s»d  th^wiS  exam¬ 
ine  legal  standards  anpfied  to  such 
Internet  investigations.  At  a  mira- 
nwt  House  Majority  leader  Okie 
Amrey,  R-Tecas,  said,  police  need  to 
toll  Congress  when,  why  and  how 
they  perform  electronic  searches. 
The  White  House  already  has 
pledged  to  move  soon  to  protect 
zteamicdstaL 

Qitks  and  privacy  experts  fear 
that  etectromt  survegiapee  of  all 
ty^s,  if  rer^ghdy  am&tfet  can 
folate  Ism  gainst  mreasonaMe 
police  searches.  The  FBft  Thomas 
Gregory  Motta  says  there  is  linfe 


BH(iM££0£ 

D  t  t'M;l  i  ii¥^ 


»E 


_ - -  8CW-H@ff 

reason  far  coKmu-H^^^^- 
Sofehe  says,  the  lafhaS1^: 
«1  Stored  records,  such  as  e-roaJJ, 
as  r  treats  other  documents,  such 
as  tetters  and  diaries,  which  can  be 
seized  ten  a  home  with  a  simple 
ssardh  warrant  Often,  though*  au** 
thonnesask  for  more  than  e.ma>i 
A  random  sample  of  14  such 
wanants  in  the  past  18  mottos 
showed  that  10  ashed  for  all  data 
the  service  had  on  targeted  sub¬ 
scribers.  They  can  get  a  record  of 
what  times  you  dated  fo.  where 
you  Sated  to  horn,  how  long  you 
were  online,  what  activities  you  ^ 
were  engaged  to,  what  Web  sates  : 
you  visited,  what  chat  sessions  you 
were  in  and  what  you  said  there,” 
said  Marie  Rasch,  a  former  federal 
prosecutor  and  vice  president  for 
cyber,  law  at  Global  integrity  in 
suburban  Washington. 
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interception  of  electronic  communication^  in 
telephone  wiretap  reports  already  required. 

*  Block  the  use  of  elecfrcnic  evidence  in  court  jfit  is  obtained  illegally.  ^ 

*  SSw  ?  g0™ent.^«s  to  the  identities  of  computer  users 

^  1S  reasonabIe  evidence  a  crime  has  been  committed. 
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UNITED  STATES  DISTRICT  COURT 
CENTRAL  DISTRICT  CP  CALIFORNIA  -  WESTERN  DIVISION 


f  IN  THE  MATTER  OF  THE 
I  APPLICATION  OF  THE  UNITED 
12 |  STATES  OF  AMERICA  FOR  AN 
|  ORDER  AUTHOR 12 ING  THE 
13  !  INS T&LLATION  OF  A  PEN 

■\  REGISTER  AND  TRAP  AND  TRACE 
14 |  DEVICE. 

15  j  - - 

IS 

17 

18 
IS 
20 
21 
22 

23 

24 

25 
2S 
2? 

28 


)  Criminal  No.  SS-2713M 
} 

} 

)  ORDER s  (ij  DENYING  NOTION  TO  QUASH 
)  ORDER  AUTHORIZING  PEN  REGISTER;  AND 
)  (25  GRANTING  APPLICATION  TO  EXTEND 

J  ORDER  AUTHORIZING  PEN  REGISTER 


This  case  raises  she  question  whether  this  court  has  the 
legal  authority  under  the  pen  register  statute,  16  o.S.C.  g  3122,  ex 
aeq.,  to  issue  an  order  requiring  an  internet  service  provider  (ISP) 
to  install  a  novice  which  captures  the  time,  date,  source  and 
destination  addressing  information  of  electronic  mail  (e-mail) 
messages  sent  to  and  from  an  e-mail  address  maintained  by  a  customer 
at  the  ISP,  After  consideration,  the  court  finds  that  it  has  the 
legai  authority  under  tne  pen  register  statute  to  issue  such  an  crcez 
The  discussion  oi  this  issue  arises  in  the  context  of  an 
j  en5°ia9  cri?ainal  investigation.  The  court  does  not  want  to  compromise 
the  integrity  of  that  criminal  investigation.  Accordingly,  the 
description  of  the  facts  out  of  which  the  current  dispute  arises 
deliberately  omits  factual  information  which  could  alert  the  subject 
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or  subj  ecte  of  the  invest: igation  to  the  existence  of  arid  the 
techniques  used  in  the  investigation. 

On  December  2,  19*9,  the  government,  through  an  Assistant 
United  States  Attorney,  presented  to  the  court  an  ex  parte  application 
for  the  issuance  of  an  order  in  the  nature  of  a  pen  register.  The 
application  contained  information  that  a  federal  criminal 
investigatory  agency  was  seeking  to  locate  a  federal  fugitive,  that 
agents  of  the  federal  agency  believed  that  the  fugitive  was 
maintaining  contact  with  a  specific  named  close  friend  or  relative 
("the  subject"]  by  means  of  e-mail  transmissions  sent  to  the  subject, 
ana  that  the  subject  maintained  an  Internet  service  account  with  a 
designated  Internet  service  provider  {"ISP")  under  the  subject's  name. 
This  court  issued  an  order  providing  that  the  government  agency  -may 
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race  device  co  register  time, 


date,  and  source  and  destination  addressing  informat  lots  of  the 
electronic  mail  messages  sent  to  and  from  the  subject  Internet 
account,  including  information,  regarding  the  true  source  of  the 
messages  without  geographic  limitation." 

The  government  agency  served  the  order  on  the  ISP.  The  ISP 
and  the  government  had  some  initial  discussion  regarding  the  order. 
Eventually,  the  isp  attempted  to  comply  with  the  order  by  providing 
the  agency  with  the  "headers’"  {minus  the  subject  or  regarding  line)  of 
numerous  incoming  messages  to  the  subject's  e-mail  account  and  the 
headers"  of  a  few  outgoing  messages  (with  the  subject  ox  regarding 
information  deleted)  from  the  subject  account.  The  government  is  not 
satisfied  with  this  response,  contending  that  the  terms  of  the  order 
entitle  it  to  install  its  own  device  on  the  premises  of  the  jgp 
connected  to  ISP's  equipment. 
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1  j>  ae  a  result  of  this  dispute,  the  IS?  has  now  moved  to  quash 

2  \  or  modify  the  order.  The  government  has  opposed  the  motion  to  quash 

3  and  separately  submitted  an.  ex  parte  application  requesting  an 
<!  extension  of  the  court's  previous  order. 

5  At  an  initial  scheduling  conference,  the  parties  represented 

6  t  that  the  court's  original  Order,  issued  December  2,  1999,  would  expire 
?!;  February  4,  2000 .  This  court  scheduled  a  hearing  on  the  ISP's  motion 

to  quash  or  modify  the  order  on  February  4,  2000.  It  now  appears  to 

i 

$[  the  court:  that:  the  order  has  already  expired,  the  statute  provides 
10  I  chat  tho  court  may  issue  an  order  authorising  the  installation  of  a 
111  oen  register  Mfor  &  Deriod  not  to  exceed  SO  days,*  18  W*3.C*  § 

12  I  3123(c)  (1) ,  The  Order  was  issued  on  December  2t  X Pursuant  to 

13  |  the  terras  of  the  statute/  the  order  expired  £0  days  thereafter  on 

14  I  w  &nua r y  3 1 «.  30  00. 

15  |  There  is  no  presently  effective  order  in  plane  which  this 

|  court  may  quash.  The  court  therefore  denies  the  ISP's  notion  to  quash 

I 

17 i  as  moot, 

I  ... 

18  a  Although  that  ruling  resolves  the  ponding  motion  of  the  ISP 

18;!  to  quaah,  it  does  not  resolve  the  underlying  issue  whether  the  court 

20  ;  has  the  authority  to  issue  an.  order.  That  issue  is  now  presented  to 

21  the  court  because  the  court  must  decide  the  government's  application 

22  I  to  extend  the  order . 

23  i  The  statute  provides  that; 

24  j  “the  court  shall  enter  an  ex  parte  order  authorizing 

as  |  the  installation  and  use  of  a  pen  register  or  a  trap  and 

'  : 

26  I  trace  device  within  the  jurisdiction  of  the  court  if  the 

27  court  finds  that  the  attorney  for  the  Government  or  the 

26 1  State  law  enforcement  or  investigative  officer  has  certified 

3 
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to  the  court  that  the  information  likely  to  be  obtained  by 
suen  installation  and  use  is  relevant  to  an  ongoing  criminal 
invest  Ication . « 
is  g.S.C.  §  3123(a) . 

The  government  has  certified  to  the  court  that  the 
information  likely  to  be  obtained  by  the  pen  register  or  trap  end 
■-race  device  is  relevant  to  an  ongoing  criminal  investigation.  This 
court  accordingly  has  authority  to  issue  a  proper  pan  register  or  tram 
and  trace  order.  The  question  presented  hare  is  whether  the  device 
which  the  government  seeks  to  install  is  a  device  described  and 
authorized  in  the  statute. 

The  statute  defines  a  "per,  register"  as  • 

*a  device  which  records  or  decodes  electronic  or  other 
impulses  which  identify  the  numbers  dialed  or  otherwise 
transmitted  on  the  cc-iephona  line  to  which  such  device  is 
attached 

18  tf.S.C,  §  3127(31. 

The  statute  describes  a  "trap  and  trace  device*  ag; 

"a  device  which  captures  ths  incoming  electronic  or  other 
impulses  which  identify  the  originating  number  of  an 
instrument  or  device  from  which  a  wire  or  electronic 
communication  was  transmitted. " 

IS  U.S.C.  §  3127(4)  . 

It  is  apparent  that  a  pen  register,  as  defined  in  the 
statute,  is  intended  to  be  a  device  which  captures  the  telephone 
numbers  dialed  by  a  target  phone,  h  trap  and  trace  device  is  intended 
to  capture  the  telephone  numbers  of  telephones  which  make  calls  to  a 
target  phone.  It  is  also  fairly  clear  that  the  drafters  of  the  pen 


5/24/02  Release  • 


$00  ft 


SOlio'cTSS'/SOilV  $n 


S828  m  cu  xVii  eotii  oo/wjfl 


FES.  *li'  SOfFRI}  09:34  ESU 


T£L:70W«32i 


register  statute  did  not  contemplate  that  the  statute  would  be  used  to 
authorize  the  issuance  of  court  orders  to  capture  the  e-mail  addresses 
of  persons  sending  e-mail  to  and  receiving  e-mail  from  a  targeted  e- 

j 

mail  address . 

The  statutory  definition  of  a  pen  register  describes  a 
device  attached  to  a  telephone  line,  28  U.S.C.  f  3127(3}  .  The 
statutory  definition  of  a  "trap  and  trace  device"  does  not  limit  the 
description  to  &  device  attached  to  a  telephone  line.  28  U.S.C.  S 
3127  {4} »  "Konsthaless,  it  appears  from  the  construction  cf  related 
sections  of  the  statutes  governing  trap  and  trace  devices  that  they 
include  only  devices  that  ere  attached  to  a  telephone  line."  Tn  thia 


devices  must  include  *  the  number  and,  if  known,  physical  location  of 


the  telephone  line  to  which  the  pen  register  or  trap  ana  trace  device  j 
is  to  be  attached  .  .  .  ,*  is  U.S.C.  §  3123(b)(1)(C).  j 

It  is  clear  that  the  government  here  does  not  intend  to 
attach  either  a  conventional  pen  register  or  a  trap  and  trace  device 
to  the  subject's  telephone  line.  The  government's  opposition  to  the 
ISP’s  motion  to  quash  contains  &  description  by  a  technician  declarant 
of  how  the  government  intends  to  implement  the  requested  order.  The 
government  would  install  a  computer  program  called  "Carnivore*  on  the 
ISP's  network,  probably  on  a  "router"  used  by  the  IS?.  A  "router1'  is 
described  as  a  transmission  device  that  processes  paeketized  network 
information .  Both  the  router  and  the  is?'  s  network  are  connected  to 
the  telephone  lines  and  transmit  paeketized  network  information  over 

5 
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1 1  telephone  lines.  Th&  Carnivore  software  program  would  look  for  the 

2  !  target's  loo -in  name  (presumably  for  outgoing  e-mail !  or  the  target's 

3  ]  electronic  nys.il  name  (presumably  for  incoming  e-mail}  .  The  program 

4!  would  then  capture  the  "header*  information  associated  with  the  e-mail 
5  message,  including  the  time,  date,  and  addressing  information, 

S,j  including  Internet  identity,  for  messages  sent  to  or  from  the  target 
7  I  account.  The  pregram  would  not  capture  the  subject  or  regarding  line 
8;!  of  the  e-mail  message  or  the  content  of  the  message.  The  captured 
s ]  material  would  be  stored  on  a  government  computer  which  presumably 
10 i  would  be  attached  to  the  IS?' s  router. 

11 f  A  conventional  pen  register  is  attached  to  telephone  lines 

12  f  and  captures  the  telephone  number  dialed  by  the  target  telephone,  A 

13  |  trap  and  trace  device  is  attached  to  telephone  lines  and  captures!  the 

14  j  telephone  numbers  calling  the  subject  telephone.  Here,  the 

15 1  government's  requested  device  is  a  computer  and  software  program 

[t 

16 !  attached  to  the  ISP's  eeuipmenfc  which  is,  in  turn*  connect  ed  to 

! 

I?  telephone  lines  and  which  captures  the  Internet  e-mail  addressee  of 
is  |  persons  sending  to  or  receiving  e-mail  from  the  target.  There  appears 

15  1  to  be  no  significant  difference  between  capturing  telephone  numbers 

20  with  a  pen  register  or  trap  and  trace  device  and  capturing  e-mail 

21  addresses  with  the  government's  proposed  computer  and  software 


22 1  program, 


This  court  acknowledges  that  the  pen  register  statute,  18 


24  |  v.S.C.  §  3122 »  m  is  contained  in  Title  III  of  the  Federal 

25  j  Electronic  Communications  Privacy  Act  of  1986 1  that  one  of  the  evident 

26  |  purposes  of  that  statute  is  to  regulate  government  intrusion  into 
27 1  private  communications,  and  that  the  statute  should  be  strictly 


ZB  1  construed,  Ic-Xibl 
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court  finds  that  the  intrusion  into  otherwiefe  private  activity  which 
would  be  allowed  by  the  issuance  of  the  government's  requested  order 
is  no  greater  than  the  intrusion  created  by  the  issuance  of  a 
conventional  pen  register  order-  Although  apparently  not  contemplated 
by  the  drafters  of  the  original  statute*  the  use  of  a  pen  register 
order  in  the  present  situation  is  compatible  with  the  tents  of  eke 
statute*  Accordingly,  the  court  will  grant  the  government's 
application  for  the  confirmed  use  of  a  pen  register  and  issue  an 


appropriate  ordes 


oriel ns 


;he  reasons  seated  above ,  the  ISP's  motion  to  quash  the 
authorising  the  installation  of  a  sen  register  is 


denied  as  moot.  The  government*  s  application  for  the  continued  use  of 
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DECIARATION 

I  Edward  Kill  hereby  declare  as  follows : 

1,  1  art;  a  Special  Agent  with  Che  Federal  Bureau  of 
Investigation,  and  have  been  an'  Agent  for  ID  years.  1  specialize 
in  technical  equipment,  including  electronic  surveillance 
equipment .  I  am  familiar  with  the  Internet  and  with  surveillance 

devices  used  for  the  internet. 

2,  if  authorised  by  this  court,  i  or  other  technicians 
intend  to  install  a  program  called  Carnivore  to  obtain  the 
information  sought  in  this  order.  The  program  will  be  installed 
©n  Karthl/ink’s  network,  most  likely  on  a  "router B  used  by 
Earthi-ink .  A  "router”  is  a  transmission  device  that  processes 
packet ised  network  information,  Both  the  router  and  EarthLink1 e 
network  are  connected  to  the  telephone  lines  end  transmit 
packet ised  network  information  over  the  telephone  lines.  Ch© 
Carnivore  software  program  watches  the  incoming  telephone  traffic 
to  EarthLink  and  looks  for  the  targeted  subscriber's  log-an  name 

i  0r  electronic  mail  account  name.  If  it  finds  the  target's  log-in 
I  n&me,  the  program  follows  the  target  while  the  target  as  on  line. 
The  program  then  captures  only  tha  header  information  for 
electronic  mail  messages  sent  or  received  fey  the  target  while  the 
target  is  on  line.  If  the  program  finds  the  target's  electronic 
!  nail  account  name,  it  will  capture  the  header  information 
associated  with  that  electronic  mil  message.  Specif ieally,  tha 
1  program  will  capture  the  time*  &Ets>  and  tha  Redressing 
inf ormation  Internet  identity)  f&r  electronic  m&xl 

|  messages  sent  to  or  from,  the  account <  The  program  will  not 
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capture  the  subject  or  regarding  line  on  the  electronic  mail 
message/  nor  dose  it  capture  the  content  of  the  message  or  any 
information  concerning  the  target's  other  ©n  line  activity. 

3.  Although  the  program  is  capable  of  capturing  more  than 
the  information  authorized  under  the  order,  I  or  the  installing 
technicians  will  configure  the  program  in  a  manner  that  will 
prevent  the  program  from  capturing  any  information  that  is  not 
authorized  under  the  order.  In  addition,  the  computer  used  to 
run  the  program  has  limited  memory  capacity  and  limited  ability 


ID  I  to  process  information.  Because  of  these  limitations  the 


computer  used  to  run  the  program  would  be  overloaded  within  a  few 
minutes  if  it  attempted  to  collect  all  of  the  information,  on 
Earthlink's  8  to  ic  million  e-mail  messages.  Moreover,  the 
program  will  be  installed  on  a  particular  entry  point  into 
Earthlink's  network,  and  as  such  would  not  have  access  to  all  cf 
Earthi-ink's  customers, 

4.  the  program-  should  not  create  a  security  risk  for 
Earthlink.  Although  the  Carnivore  program  is  remotely 


13 !  accessible,  it  has  several  security  provisions  that  prevent  an 

20  •  intruder  from  obtaining  unauthorised  access  to  Earthlink' s 

21 {  system,  svsn  if  an  intruder  did  obtain  such  access,  the  program 

22  lacks  a  TCP/IP  protocol  stack,  which  means  that  the  intruder 

23  i  would  be  unable  to  communicate  with  Earthlink's  eye  tern  from  the 

24  government's  computer.  I  and  other  agents  with  whom  1  work  have 

25  Installed  this  program  at  many  other  service  providers  (including 

26  AT&T}  and  have  not  had  security  problems  or  objections  from  the 

27  -  providers. 

28  25 


5/24/02  Refcsse  -  Page  SO; 


4/5/00  5:29PM 


To;  BOWMAN,  SPIKE  . 

Oats:  ;  .  '  4/5/00  &23PM  ■  ‘  .  ;.  '  \  '  X 

Subject:  •' 

j  just  recetvW  a  call  fronSHKl  OIPR;  Tq  state  tftat  Shift  unhappy.  v^tITOS  and  the 
UBLUnitwsuklbean  undSS3emiwwine!&&te; groportittft,  •.Fwilify Jo  relate  thinks  has 

happened  with,  the  above  earned  PISA.  •  •  •  .  '■  .  . 


■■Mlsecured  an  Et-SUR  FlSAjvery  quickly'  amtfm  the  request  of  _ 
thatsne  was  assured’  that  the  FBI  had  special  softwarelwHibh  cpulddo  w 
fectJHBistates  that  the  technical  people  In  Quantico- approved  the  FISA  language. 


KftiitnitfciraKKl 


coScTdo.  in 


The  FBI  technical  people  went  to  install  the  FBI  software 
electronic  surveillance  on  March  16: 


accomplish  the 


The  software  was  turned  oh. and  did  not  work  corredly^the  FBfsoff^atre  not  only  picked  up  the  E-Mails 
under  the  electronic  surveillance  of  the  FBI’s  but  ^Isp  picked  up  E*Mai!s  on  noivcovared 

targets*  The  FBI  technical  person  was  apparently  so  upsetthat  he  destmy^a|th^-Mail  take,  including 
the  take  on  **' impression  thatno  one  from  the  FS^HjHB  was  present  to 

supervise  theFBUecrpcal  person- at  the  time.  Now  the  Fgt  teohhi^tpeoplIwannoW^  new  software 
experiment  at  the  carrier  to  sea  if  it  works.  ■  ’*  ■  •*  *  ;  -  /  ' '  *  x 

MHkstafes  thafOiPR  was.never  told  that  the  FBI  software  was  experimental  OIPR  was  Informed  that  it 
wouMwork.  '  The  FSi  technical  people  are  st®  trying  to  make  \l work  ln0 (lift  and  want  to  resume  the 
electronic  surveillance.  The  FBI  people  In |pfc|j^ateo  want  a  physical  search  warrant  to  pick  up  the 
E-Mails  from  the  carrier,  which  the  FBI  picked  upon  the  target,  put  destroyed* 

M|  informed  mo  that  the  FBI  does  not  have  Ihe  authority  to  resume  electronic  surveillance  until  she 
receives  a  written  explanation  of  what  has  happened  and  she  files  something  with  the  court.  Obviously, 
she  has  no  Intention  o?  securing  a  search  warrant  either  until,  this  is  straightened  out. 

When  you  add  thfe  story  to  the  Fi$A mistakes cov£jg|^^  to  go  to  the  field,  and 

which  Is  h  NSdJ  for  signature  before  It 'goes  hlF  sIphature,  you  have  a  pattern  of 

occurrehces  which  indicate  to  OIPR  an  inability  orf4fte  part  of  the  FBI  to  manage  its  PIS  As  . 

HHHH'andHHHbiease  see  me  ASAP. 


S/24/01  Release 


DITU  Legal  issues 


Date: 

Subject: 


Tue,  Apr  11,2000  9:00  AM 
DITU  Legal  Issues 


The  attached  sets  out  a  few  Issues  we  would  like  to  discuss  with  you  so  that  we  can  work  toward 
providing  a  reasonalbe  and  practical  guideline  to  personnel  in  our  Unit  and  the  Field. 


My  number  is  703| 


I  will  bo  on  leave  from  Thursday  through  next  Tuesday. 


£>7  C-l 
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The  following  sets  out  some  of  the  legal  issues  facing  DITu 
as  well  as  some  thoughts  on  ways  to  proceed-  We  need  your  legal 
guidance  in  this  matter"  to  formulate  a  reasonable  and  prudent 
course  of  action,  as  well  as  a  practical  working  guide  for  the 
personnel  of  DITU  and  the  Field  Office  personnel  involved  in  Data 
Intercepts-  I  am  sure  there  are  other  issues  and  ideas,  but  this 
may  be  a  good  start.  Call  me  to  discuss  this  in  more  detail.  I 
am  willing  to  travel  to  your  office  at  FBIHQ  or  to  meet  with  you 


here  at  QT.  If  you  need  any  clarification  of  technical  concepts 


■qu  may  call  SSA 


fat  703* 


or  SSA 


To  initiate  an  intercept  on  a  network  or  at  an  ISP,  the  DITU 
installs  a  collection  device  with  appropriate  filters  set  to 
capture  data  within  the  scope  of  the  Court  Order  or  the  effective 
consent  of  a  consenting  party.  This  filtering  process,  a 
component  of  Ether peek  and  Carnivore,  filters  based  on  TCP/IP 
standards.  On  occasion  we  encounter  non-standard  implementation 
of  transmission  control  and  Internet  protocols  within  a  network 
or  at  an  ISP.  Encountering  non-standard  implementation  has  led 
to  inadvertently  capturing  and  processing  data  outside  the  Order 
or  Consent , 


[  ssuej 


In  instances  where  we  encounter  non-standard  implementation 
of  a  protocol  which  leads  to  the  improper  capture  of  data,  two 
main  concerns  arise .  The  first,  and  of  most  immediate  concern, 
is  the  formulation  of  a  guideline  to  be  followed  in  resolving  the 
matter.  This  guideline  should  extend  from  the  DITU  personnel  who 
installed  and  likely  discovered  the  error,  through  DITU 
Management  representatives.  Field  Division  Case  Agents,  CDCs, 
notifications  to  AUSAs ,  Motions  to  Seal.  etc. 


Issue  II 

The  second  issue,  critical  in  efforts  to  intercept  the  data 
under  the  Court's  Order  or  under  consent  from  a  test  account,  is 
how  FBI  technical  personnel ,  such  as,  Engineers,  Computer 
Programmers  and  others,  may  lawful  examine  the  collected  data  for 
the  sole  purpose  of  determining  why  the  filters  failed  and  what 
software  changes  need  to  be  made  to  bring  the  collection  in  line 
with  the  scope  of  the  existing  Order.  We  need  to  look  at  the 
data  to  figure  out  what  is  wrong  and  how  to  fix  it  Hi 
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Issue  III 


A  third  issue  which  we  would  like  you  to  consider  is  that  we 
frequently  set  up  user  accounts  on  networks  and  install  data 
intercept  devices  to  perform  a  "test  tap"  under  our  own  consent. 
This  is  generally  done  as  a  means  of  verifying  that  the  location 
on  the  network  and  the  filter  set  would  be  appropriate  for  an 
anticipated  or  existing  intercept  Order.  In  the  event  that  we 
are  doing  a  "test  tap"  under  consent,  looking  for  our  own  mail, 
etc,  and  inadvertently  capture  something  outside  our  consent, 
such  as  another  persons  mail,  what  are  our  options?  Is  it  a 
violation  of  Till  if  the  interception  is  not  intentional  and  we 
do  not  disclose  or  endeavor  to  disclose  the  information  to 
anyone?  May  we  destroy  the  information  and  simply  not  disclose 
it  to  anyone? 


Issue  IV 

Random  Access  Memory  RAM 


In  relation  to  the  "testing"  of  network  placement  and 
filters,  it  is  generally  a  technical  requirement  to  install  the 
device  with  appropriate  filters  set  and  initiate  the  capture 
process.  It  may  be  hours  or  days  before  a  determination  can  be 
made  as  to  the  functional  operation  of  the  collection.  During 
these  first  few  hours  or  days,  the  technical  representatives  of 
the  FBI,  Electrical  Engineers,  Electronics  Engineers,  Technically 
Trained  Special  Agents  and  others  may  frequently  examine 
collected  data  to  determine  the  efficacy  of  the  installation.  In 
relation  to  the  time  period  from  installation  to  the  verification 
of  proper  function,  the  following  question  is  posed  for  your 
consideration.  Is  there  a  significant  legal  difference  between 
Random  Access  Memory  (RAM) ,  that  which  is  not  retained  when  power 
is  removed,  and  of  a  hard-drive  or  floppy  disk  which  retains  the 
data.  The  thought  process  here  in  the  DXTU  being  that;  during 
the  period  of  time  from  the  installation  to  the  verification  of 
proper  function, • the  data  could  be  directed  to  remain  in  RAM  and 
not  be  forwarded  to  a  permanent  media.  Technical  representatives 
could  then  examine  the  collected  data  for  proper  filtering  and 
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V. 


assure  that  the  collection  is  operating  within  the  scope  of  the 
Order. 

If  the  collection  appears  technically  correct,  it  could  then 
be  re-directed  from  RAM  to  permanent  media  and  the  intercept 
initiated.  If  not,  the  data  could  be  examined  in  RAM  by  Computer 
Programmers/Engineers  to  determine  a  filtering  change  or  software 
patch  necessary  to  effect  the  Court  Ordered  intercept.  The  data 
in  RAM  would  not  be  retained  by  the  computer  on  power-off. 

By  directing  collected  data  to  remain  only  in  RAM,  we  may 
gain  both  the  ability  to  troubleshoot  installations  and  to  assure 
that  the  data  is  not  written  to  "storage  media"  nor  recoverable 
from  any  media. 
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ISP  INTERCEPTS f  MAIL 


From: 

To: 

Date: 

S  object: 


THOMAS,  MARCUS  C 


t  2000  5:53  PM 


ISP  INTERCEPTS  E-MAIL 


See  the  attached.  After  you  all  get  a  chance  to  review  my  initial  thoughts  regarding  your  questions/issues, 
lets  then  plan  to  sit  down  and  talk. 


„  i-ftse-rw5" 

sW»wl*** 

-ice.  “=7 


4/12/2000 


TO:  Marcus  Thomas 


FROMHB 

RE:  Intemet/E'Mail  Intercepts 

This  is  in  response  to^^^^^jJ^^E-mail  of  4/3  3  regarding  the  captioned  matter.  I 

The  following  are  some  preliminary  reactions  and  thoughts.  They  are  not  necessarily  final  legal 
answers  or  guidance.  They  are  offered  to  stimu  late  further  consideration  on  all  of  our  parts.  As 
was  suggested  in  the  E-mail,  we  all  need  to  sit  down  in  the  very  near  future  and  take  a  little  time 
to  talk  about  our  intercept  approaches,  as  well  as  what  we  must  do  when  they  unintentionally  go 
astray. 

Background: 

We  need  to  start  with  a  few  high-level  and  familiar  thoughts,  because  they  form  a  background  and 
context  for  the  subsequent  discussion.  As  we  are  all  aware  and  appreciate,  electronic  surveillance 
is  a  very  sensitive  investigative  (and  mteiligente/eounierinielligenee)  technique,’  As  such,  for 
over  30  years,  it  has  been  carefully  regulated  by  and  tluough  statutory  regimes  at  both  the  Federal 
and  State  levels  —  which  regimes,  in  many  instances,  contain  provisions  that  arc  very  specific,  and 
which  contain  dictates  that  are  quite  detailed  in  their  procedural/administrative  aspects.  On  its 
face,  the  language  of  these  regimes,  as  written  by  the  Congress,  is  essentially  black  and  white,  and 
generally  is  unforgiving:  one  complies  with  the  statutes  or,  alternatively,  violates  them.  In 
enacting  these  regimes.  Congress  sought  to  balance  and  advance  privacy  and  effective  law 
enforcement.  Moreover,  given  the  sensitivity  of  this  technique,  electronic  surveillance  has  been 
the  subject  of  on-going  scrutiny  by  Congressional  oversight  committees,  the  press,  privacy 
groups,  and  the  public.  In  short,  there  are  few,  if  any,  investigative  techniques  that  are  (and  have 
been)  subjected  to  such  heightened  scrutiny.  And  there  are  few,  if  any,  investigative  techniques 
that  gamer  (and  have  garnered  in  the  past)  such  vehement  criticism  when  errant  surveillances  or 
missteps  (be  they  intentional  or  unintentional)  occur. 

While,  as  noted  above,  the  electronic  surveillance  laws  are  often  specific  and  detailed  in  their 
provisions,  general  ly  they  do  not  address  the  precise  aspects  of  how,  technical  speaking,  the 
“intercept”  is  to  occur.  Congress  eschewed  doing  so  because  it  would  be  a  bad  idea  to  tty  to 
delineate  all  the  various  potential  interception  methodologies/approaches.  To  do  so  would 
infringe  upon  Executive  Branch  prerogatives  in  “executing”  the  laws.  And,  it  would  get  into 
sensitive  intercept  sources  and  methods,  etc.  Nevertheless,  both  the  Congress  and  the  courts  have 

1  While  we  in  our  particular  area  of  law  enforcement  are  so  close  to  thi  s  matter  that  we 
literally  live  and  breathe  electronic  surveillance,  to  others  (especially  those  outside  of  law 
enforcement),  any  electronic  surveillance  is  a  big  thing! 
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an  extremely  keen  interest  in  making  sure  that  several  things  are  being  attended  to  by  the 
Executive  Branch  in  conducting  electronic  surveillance  searches  and  seizures:  (1)  that  illegal, 
unconstitutional  searches  are  not  occurring  (i.e.,  that  no  searches  of  persons*  communications  are 
occurring  without  probable  cause/warrant/emergency);  and  (2)  that  the  spirit/intent/letter  of  the 
electronic  surveillance  laws  (as  implemented  of  constitutional  law  -  at  least  to  a  degree)  are 
being  carried  out  carefully  and  judiciously.  One  aspect  of  this  involves  the  requirement  that  such 
surveillances  only  be  approved  with  high-level  departmental  approval  and  with  on-going 
Departmental  legal/administrative  oversight. 

Interceptions  of  the  “Older”  Communications  Technology 

It  is  probably  fair  to  say  that,  historically.  Congress  has  been  of  the  opinion  (and  correctly  so) 
that,  for  Jaw  enforcement,  effecting  a  lawful  interception  was  not  a  particularly  problematic 
endeavor.  Typical  wire  line  sen-ice  lent  itself  to  reasonably  easy  segregat  ion  of  a  target’s 
communications  to  the  target  line,2  and  thus  to  concomitantly  effecting  lawful  (and  effective 
technically-targeted)  interceptions.  With  other  identifiers  (ESNs,  MINs,  Cap  Codes,  etc,)  being 
available,  accurately  targeted  interceptions  of  cellular  phones  and  pagers  could  likewise  be 
effected  by  law  enforcement.  Importantly,  Congress  understood  that,  in  order  to  effect  accurate 
interceptions,  law  enforcement  would  seek  and  obtain  assistance  from  electronic  communication 
service  providers  (BCSPs)  and/or  others  to  properly  conduct  the  intercept  (“...upon  request  [of  an 
ECSP,  it  shall]  furnish  the  applicant  forthwith  all  information,  facilities,  and  technical  assistance 
necessary'  to  accomplish  the  interception  ...  with  a  minimum  of  interference  with  the  sendees  [the 
ECSP  is  according  to]  the  person  whose  communications  are  to  be  intercepted”).  251 8  U.S.C. 
2518(4).  Until  1994  (see  below),  there  is  no  clear  indication,  in  the  statutes  or  otherwise,  that 
Congress  ever  understood  interception  accuracy  to  be  an  issue  for  law  enforcement. 

Where  potential  “over-acquisitions”  could  arise.  Congress,  privacy  groups,  and  others  have 
homed  in  and  taken  an  interest.  For  example,  with  regard  to  pen  register/DNRs,  Congress  and 
others  have  been  concerned  about  certain  (but  not  all)  post  cut-through  dialing  -  i.e.,  certain 
dialing  that  arguably  constitutes  a  substantive  communication  -  even  though  related  to  the  target 
individual  (as  opposed  to  communications  of  others).  In  this  regard,  Congress,  as  part  of  the 
CALEA  legislation,  specified  in  18  U.S.C.  3121(c)  that  law  enforcement  “shall  use  technology 
reasonably  available  to  it  that  restricts  the  recording  or  decoding  of  electronic  or  o  ther  impulses  to 
the  dialing  or  signaling  information  utilized  in  call  processing.”  Similarly,  under  CALEA’ s 
assistance  capability  requirements.  Congress  specified,  as  a  statutory  requirement  as  part  of  the 
interceptionpapabiljty,  that  telecommunications  carriers  meet  their  obligation  “in  a  manner  that 


?  One  possible  exception  being  “party-line”  service,  which  by  now  is  pretty  rare.  Its 
unclear  exactly  what  Congress  would  think  about  such  party-line-related  intercepts.  Presumably, 
minimization  could  be  employed  to  parse  the  target  subscriber’s  calls.  But,  at  the  end  of  day, 
under  the  statu  tory  regime/language,  the  telephonic  communications  being  targeted  for 
interception  would,  in  fact,  be  occurring  over  the  properly-targeted  telephone  line/facilitv.  Here, 
law  enforcement  would,  at  least,  be  on  the  correct  line/facility  that  had  been  authorized  for 
interception  by  the  court. 

2 
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protects ...  the  privacy  and  security  of  communications  and  call-identifying  information  not 
authorized  to  be  intercepted.../’  47  U.S.C.  1002(a)(4)(A). 

Internet  and  E-mail  Sendee  Providers 


Both  Internet  Service  Providers  (ISPs)  and  E-mail  service  providers  are  comprehended  within  the 
term  “providers  of  ‘electronic  communication  service”'  under  the  ECPA  and  Title  III/FISA.  See, 
e.g.,  1 8  U.S.C.  2510(15).  Moreover,  certain  facets  of  E-mail/ISP  service,  at  least  with  regard  to 
the  acts  of  transmitting  and  routing  wire/electronic  communications,  can  also  constitute  activity  of 
a  telecommunications  earner,’  thereby  subjecting  the  communieations/carrier  to  the  provisions 
ofCALEA,  See  47  U.S.C.  1001(8).  Accordingly,  certainly  under  the  £CP A/Title  Ht/FISA  (and 
perhaps  under  CALEA),  such  electronic  communication  sendee  providers  are  mandated  to  afford 
all  the  necessary  assistance  to  properly  effectuate  an  interception  of  electronic  communications. 
Consequently,  whenever  there  is  an  electronic  surveillance  order,  and  whenever  there  are  any 
questions  about  “standard/non-standard  transmission  controi(s),”  “protocols,”  or  any  other 
technical  information  matter  of  consequence  in  properly  and  accurately  effecting  electronic 
surveillance,  these  sendee  providers  are  duty-bound  to  work  with  us  in  properly  and  lawfully 
effecting  the  surveillance  order. 


Interaet/E-mail  Interceptions 

In  the  referenced  DITU  E-mail,  it  is  explained  that  certain  Etheipeek  and  Carnivore  "filters”  are 
utilized  to  (hopefully)  capture  data  (and  only  that  data)  authorized  for  interception  in  an  electronic 
surveillance  order  or  pursuant  to  consent.  The  E-mail  mentions  that,  on  occasion,  when  non¬ 
standard  implementations  have  been  encountered,  data  outside  the  court  order  or  consent  have 
been  captured  and  processed  inadvertently.  DITU  then  presents  several  issues  for  examination.  In 
the  tust  two,  DITU  (1)  seeks  guidance  as  to  formulating  guidelines  for  reacting  to  such 
Inadvertent  interceptions  and  (2  )  whether  additional  examination  of  such  non-authorized  data  is 
permitted  to  remedy  the  errant  collecnoaTIitering  efforts. 

As  noted  in  the  background  comments,  the  electronic  surveillance  statutes  speak  at  a  rather  high 
level,  and  are  essentially  black  and  white  in  nature  —  with  one  either  complying  with  the  law  or 
facially  violating  it.  The  Title  III  statutes,  generally  speaking,  are  not  “specific  intent”  statutes. 
That  is,  one  does  not  need  to  have  special  or  particular  bad  intention  or  motive  to  facially  violate 
the  law.  Further,  since  the  protection  of  personal  communications  privacy  is  a  key  facet  of  the 
statutory  purpose  and  regime,  any  unauthorized  interception  of  another’s  communications  is  a 
matter  of  concern  (at  a  minimum).  Indeed,  some  might  argue  that  the  government’s  unauthorized 
interception  of  such  communications  is  even  more  problematic. 

Historically,  as  a  matter  of  Departmental  practiee/policy,  unauthorized  interceptions  (be  they  of 
the  subject  of  the  interception  or  others)  have  been  taken  seriously  by  DOJ  (and  by  the  FBI  for 
that  matter).  When  detected,  DOJ  has  advised  AUSAs  to  (1)  file  a  pleading  with  the  court 
explaining  the  unintentional/intentional  act  and  to  (2)  seal  the  unauthorized' intercepted 
communications  with  the  court,  in  order  to  prevent  further  harm  such  as  subsequent  use  or 
fesISSMES  (see  18  U.S.C.  251  l(l)(c)(d),  2515).  Such  unauthorized  interceptions  not  only  can 
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violate  a  citizen’s  privacy  but  also  can  seriously  “contaminate"  ongoing  investigations.  In 
addition,  DOJ  could  also  counsel  the  AUSA  to  recommend/not  recommend  to  the  court  whether 
or  not  the  person(s)  who  communications  were  improperly  intercepted  should  be  notified. 

Interestingly,  under  Section  251  l(2}(a)(ii),  while  Title  HI  specifies  that  “no  [criminal]  cause  of 
action  shall  lie  in  any  court  against  any  provider  of  wire  or  electronic  comm  unication  service,  its 
officers,  employees,  or  agents,  landlord,  custodian,  or  other  specified  person  for  providing 
information,  facilities,  or  assistance  in  accordance  with  the  terms  of  a  court  order  or  certification 
[under  Title  III],"  there  is  no  similar  explicit  protection  for  law  enforcement  personnel  under  this 
provision.  Now,  practically  speaking,  there  is  virtually  no  chance  that  law  enforcement  officers 
acting  in  good  faith,  pursuant  to  a  court  order,  are  going  to  be  criminally  prosecuted  (or  even 
investigated)!  As  to  civil  liability,  under  1 8  U.S.C.  2520(d),  Title  HI  states  that  “a  good  faith 
reliance  on .  ..  a  court  warrant  or  order,  a  grand  Jury  subpoena,  a  legislative  authorization,  or  a 
statutory'  authorization...  is  a  complete  defense  against  any  civil  or  criminal  action  brought  under 
[Title  HI]  or  any  other  law."  So,  here  too,  law  enforcement  personnel  should  be  immune, 
practically  speaking,  from  any  liability.  (Further,  even  if  (in  a  semi-egregious  case)  liability  were 
to  be  found,  it  would  almost  certainly  fall  to  the  agency  —  not  the  agent/support  personnel.) 
However,  the  FBI  itself  routinely  does  conduct  OPR-type  inquiries,  from  an  administrati  ve 
perspective,  in  order  to  determine  the  nature/cause,  etc,  of  any  investigative  missteps  or  errors 
which  facially  violate  a  law,  with  an  eye  toward  preventing  future  reoccurrences,  etc. 

In  a  similar  fashion,  missteps  under  FISA  lead  to  mandatory  reporting  to  the  President’s  Foreign 
Intelligence  Advisory  Board  (PFIAB),  and  such  errancies  must  be  reported/explained/justified  to 
Congress. 

Issue  #1: 

In  short,  then,  as  to  the  first  issue,  upon  detecting  an  inadvertent,  unauthorized  (unlawful) 
interception; 

A)  the  technical  effort  that  is  causing  the  mistake  should  be  stopped  immediately  (and  not  re- 
instituted  until  advised  to  do  so  by  the  supervising  attorneys); 

B)  the  error  should  be  reported  immediately  to  the  FBI  substantive  ease  personnel  in  the 
field/headquarters  (as  appropriate),  to  the  field  office  TA  and  CDC,  and  to  the  respective 
AUSA/OIPR  supervisory  attorney  (who,  in  turn,  will  presumably  advise  the  court); 

C)  the  reporting  as  to  the  errant  interception  should  be  careful  and  clear  so  that  those  to  whom  it 
is  reported  will  folly  understand  what  happened;  the  reporting  should  not  include  any 

substantive  aspect  of  the  content  of  the  communication  that  may  have  been  gleaned;  and 

D)  the  unauthorized  intercepted  material  should  be  segregated  immediately  as  a  prelude  to  formal 
sealing  with  the  court. 

Issue  #2: 


As  to  “examining"  the  unauthorized  intercepted  data  (albeit  for  the  sole  purpose  of  determining 
why  the  filters  failed  and  what  changes  need  to  be  made),  this  is  a  very  delicate  and  potentially 
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problematic  area.  It  would  appear  that  continuing  to  look  at  (examine  and  “use”)  the  substantive 
content/plain  text  of  the  material  that  was  not  authorized  for  interception  would  most  aggravate 
Title  Ill’s  concerns/ dictates  (see  Sections  251 1  and  2515),  and  most  likely  would  heighten  the 
legal  problem  in  the  minds  of  the  Department,  FBI-OPR,  the  court,  Congress,  privacy  groups,  the 
public,  etc.  I  f,  on  the  other  hand,  there  is  some  way  of  looking  at  the  signaling,  programing, 
protocols,  etc.  hi  a  raw/uninteliigihle state  (lean  amplify  later),  this  might  be  okay  if  (1)  it  is  for 
the  sole  purpose  of  determining  why  the  filters  failed  and  what  changes  need  to  be  made,  and  i  f 
(2)  it  is  approved  by  the  AUSA/OIPR  (and/or  the  court  if  the  AUSA/GIPR  believe  warranted  - 
such  court  permission  in  this  area  would  presumably  be  preferable  from  the  perspective  of  legal 
protection  for  our  technical  people).  Another  thought  I  would  strongly  encourage  is  to  engage  the 
ISP.  That  is,  if  there  is  a  technical  (filter)  failure  problem  regarding  the  interception,  it  would 
appear  to  be  much  much  more  preferable  for  the  ISP  to  try  to  fix  it  (even  with  us  coaching  and/  or 
guiding  technically  from  afar).  The  reason  for  fully  utilizing  the  ISP  is  the  existing  mandate  for 
their  assistance,  etc.  under  the  law,  and  because  of  the  “cover"  it  affords  us  legally,  politically, 
and  perceptionaliy. 


Issue  U 3: 


D1TU  poses  a  similar  issue  as  to  one  its  own  “test”  accounts  where  an  inadvertent,  unauthorized 
interception  occurs.  Again,  we  have  to  be  very  careful  here,  even  where  “testing"  is  our  activity, 
because  the  potential  harm/violation  of  pri  vacy  is  arguably  the  same.  Somehow,  when  we  test, 
we  have  to  go  out  of  our  way  to  avoid  tripping  over  innocent  third  party  communications.  I  am 
not  sure  how  we  can  proceed  to  test  without  inadvertently  intercepting  the-  communications  of 
others,  but  we  really  need  to  try.  Perhaps,  we  can  explain  our  testing  requirement  to  the  ISP  and 
get  them  to  test  our  filters,  etc.  for  us,  since  it  is  their  network,  and  since  they  administrate  it,  etc, 
anyway.  I  would  really  encourage  using  the  ISPs  for  many  reasons,  not  the  least  of  which  is  to 
make  them  aware  of  us  popping  around  in  their  network  to  conduct  testing,  etc. 


Issue  #4: 

DITU  asks  whether  interception  collections  effected  in  Random  Access  Memory  (RAM)  (rather 
than  permanent  media)  make  any  significant  legal  difference.  In  short,  I  would  say  probably  not 
as  a  purely  legal  matter,  inasmuch  as  an  unauthorized  interception  is,  after  all,  an  unauthorized 
interception.  How,  having  said  that,  it  may  make  some  feel  better  that  the  potential  for  ongoing 
“use"  and  “disclosure”(through  some  permanent  storage  media)  may  be  somewhat  reduced  -  but  I 
don’t  think  this  is  the  path  to  take.  As  alluded  to  above,  I  would  opt  for  more  controlled  testing 
and  utilizing  sendee  providers  as  much  as  possible  to  create  some  insulation  between  us  and  the 
subscriber  public  where  inadvertent  interceptions  might  arise  in  the  course  of  our  trying  out  our 
filters,  etc. 
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FBI  Using  Internet  Wiretap  System  (washingtonpost.com) 

By  John  Schwartz 
Washington  Post  Staff  Writer 
Tuesday,  July  1 I ,  2000;  Page  A1 

The  FBI  has  deployed  an  automated  system  to  wiretap  the  Internet,  giving 
authorities  anew  tool  to  police  cyberspace  but  drawing  concerns  among 
civil  libertarians  and  privacy  advocates  about  how  it  might  be  used. 

The  new  computer  system,  dubbed  "Carnivore”  inside  the  FBI  because  it 
rapidly  finds  the  "meat”  in  vast  amount  s  of  data,  was  developed  at  FBI 
computer  labs  in  Quanttco,  Va.,  and  has  been  used  in  fewer  than  50  cases 
so  far. 

But  that  number  is  sure  to  rise,  said  Marcus  Thomas,  chief  of  the  FBI’s 
cyber-technology  section  at  Quantico.  ”In  criminal  situations  there’s  not 
yet  been  a  large  cal!  for  it,"  he  said,  but  the  bureau  already  has  seen 
"growth  in  the  rate  of  requests.” 

Civil  liberties  groups  said  the  new  system  raises  troubling  issues  about 
what  constitutes  a  reasonable  search  and  seizure  of  electronic  data.  In 
sniffing  out  potential  criminal  conduct,  the  new  technology  also  could 
scan  private  information  about  legal  activities. 

'  it  goes  to  the  heart  of  how  the  Fourth  Amendment  and  the  federal  wiretap 
statute  are  going  to  be  applied  in  the  Internet  age,"  said  Marc  Rotenberg, 
head  of  the  Washington-based  Electronic  Privacy  Information  Center.  ' 

The  new  system,  which  operates  on  off-the-shelf  personal  computers,  takes 
advantage  of  one  of  the  fundamental  principles  of  the  Internet;  that 
virtually  all  such  communications  are  broken  up  into  "packets,”  or  uniform 
chunks  of  data.  Computers  on  the  Internet  break  up  e-mail  messages.  World 
Wide  W'eb  site  traffic  and  other  information  into  pieces  and  route  the 
packets  across  the  global  network,  where  they  are  reassembled  on  the  other 
end. 

FBI  programmers  devised  a  "packet  sniffer"  system  that  can  analyze  data 
flowing  through  computer  networks  to  determine  whether  it  is  part  of  an 
e-mail  message  or  some  other  piece  of  Web  traffic. 

The  ability  to  distinguish  between  packets  allows  law  enforcement 
officials  to  tailor  their  searches  so  that,  for  example,  they  can  examine 
e-mail  but  leave  alone  a  suspect’s  online  shopping  activities.  The  system 
could  be  tuned  to  do  as  little  as  monitoring  how  many  e-mail  messages  the 
suspect  sends  and  to  whom  they  are  addressed  u  the  equivalent  of  a 
telephone  "pen  register,"  which  takes  down  telephone  numbers  being  called 
without  grabbing  the  content  of  those  calls. 

"That's  the  good  news,”  said  James  Dempsey,  an  analyst  with  the  Center  for 
Democracy  and  Technology,  a  Washington  high-tech  policy  group.  "It  is  a 
more  discriminating  device"  than  a  full  wiretap,  he  said. 

But  Dempsey  expressed  worries  about  the  new  system,  which  would  be 
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from  pen-register  data  to  Ml  wiretaps  with  court  authorization,  "It’s 
not  an  increase  in  our  authority;  it  doesn't  present  a  change  of  volume  in 
what  we  do,"  he  said, 
r-  2000  The  Washington  Post  Company 
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FBI  e-mail  Snooping  Device  Attacked 


July  11,2000 

Filed  at  7:26  p.ra.  EDT 
By  The  Associated  Press 

WASHINGTON  (APj  —  C  nil  liberties  and  privacy  groups  railed  Tuesday 
against  a  new  system  designed  to  allow  law  enforcement  agents  to 
intercept  and  analyze  huge  amounts  of  e-mail  in  connection  with  an 
investigation. 

The  system,  called  "Carnivore,"  was  first  hinted  at  on  April  6  in 
testimony  to  a  House  subcommittee.  Now  the  FBI  has  it  in  use. 

When  Carnivore  is  placed  at  an  Internet  Service  Provider,  it  scans  all 
incoming  and  outgoing  e-mails  for  messages  associated  with  the  target 
of  a  criminal  probe. 

In  a  letter  addressed  to  two  members  of  the  House  subcommittee  that 
deals  with  Fourth  Amendment  search-and -seizure  issues,  the  American 
Civil  Liberties  Union  argued  that  the  system  breaches  the  Internet 
pro  vider's  rights  and  the  rights  of  all  its  customers  by  reading  both 
sender  and  recipient  addresses,  as  well  as  subject  lines  of  e-mails, 
to  decide  whether  to  make  a  copy  of  the  entire  message. 

Further,  while  the  system  is  plugged  into  the  Internet  provider's 
systems,  it  is  controlled  solely  by  the  law  enforcement  agency.  In  a 
traditional  wiretap,  the  tap  :s  physically  placed  and  maintained  by 
the  telephone  company. 

"Carnivore  is  roughly  equivalent  to  a  wiretap  capable  of  accessing 
the  contents  of  the  conversations  of  all  of  the  phone  company's 
customers,  with  the  ’assurance*  that  the  FBI  will  record  only 
conversations  of  the  specified  target,"  read  the  letter.  "This 
'trust  us,  we  are  the  government'  approach  Is  the  antithesis  of  the 
procedures  required  under  our  wiretapping  laws." 

Batty  Steinhardt,  associate  director  of  the  ACLU,  said  citizens 
shouldn't  trust  that  such  a  sweeping  data-tap  will  only  be  used 
against  criminal  suspects.  And  even  then,  he  said,  the  data  mined  by 
Carnivore,  particularly  subject  lines,  is  already  intrusive. 

"Law  enforcement  should  be  prohibited  from  installing  any  device  that 
allows  them  to  intercept  communications  from  persons  other  than  the 
target,”  Steinhardt  said  in  an  interview.  "When  conducting  these 
kinds  of  investigations,  the  information  should  be  restricted  to  only 
addressing  information." 

A  spokeswoman  for  Rep.  Charles  T.  Canady,  R-Fla.,  who  heads  the 
Constitution  subcommittee,  said  that  the  congressman  had  no  immediate 
comment  on  the  Setter. 

In  testimony  to  Canady's  subcommittee,  Robert  Cora-Revere,  a  lawyer  at 
the  Hogan  &  Hartson  law  firm  in  Washington,  said  that  he  represented 
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an  Internet  provider  that  refused  to  install  the  Carnivore  system.  The 
provider  was  placed  in  an  "awkward  position,"  Com-Revere  said, 
because  the  company  feared  suits  from  customers  unhappy  with  the 
government  looking  in  to  all  the  e-mail. 

"It  was  acknowledged  (by  the  government)  that  Carnivore  would  enable 
remote  access  to  the  ISP’s  network  and  would  he  under  the  exclusive 
control  of  government  agents,"  Com-Revere  said, 

Com-Revere  told  the  committee  that  current  law  is  insufficient  to 
deal  with  Carnivore's  potential  and  that  the  Internet  provider  lost 
their  court  battle  in  part  because  of  the  Internet’s  connection  to 
telephone  lines,  and  that  the  law  was  stretched  to  cover  the  Internet 
as  well, 

Com-Revere  would  not  reveal  the  name  of  his  client,  and  the  client 
lost  the  case.  He  said  that  the  FBI  has  been  using  Carnivore  since 
early  this  year. 

J  ames  X.  Dempsey,  senior  staff  counsel  at  die  Center  for  Democracy  and 
Technology,  said  that  the  main  problem  with  Carnivore  is  it's  mystery. 

"The  FBI  is  placing  a  black  box  inside  the  computer  net  work  of  an 
ISP,"  Dempsey  said.  "Not  even  the  ISP  knows  exactly  what  that  gizmo 
is  doing," 

But  Dempsey  said  that  Internet  providers  contributed  to  the  problem, 
by  saying  that  current  technology  does  not  allow  the  internet  provider 
to  soil  out  exactly  what  the  government  is  entitled  to  get  under  a 
search  warrant.  The  carriers  complained  that  they  had  to  give 
everything  to  the  FBI. 

'  The  service  providers  said  they  didn't  know  how  to  comply  with  court 
orders,"  Dempsey  said.  "By  taking  that  position,  they  have  hurt 
themselves,  putting  themselves  into  a  box," 

Marcus  Thomas,  who  heads  the  FBI’s  Cyber  Technology  Section,  told  the 
Wall  Street  Journal  that  the  bureau  has  about  20  Carnivore  systems, 
which  are  PCs  with  proprietary  software.  He  said  Carnivore  meets 
current  wiretapping  laws,  but  is  designed  to  keep  up  with  the 
Internet. 

'  'This  is  just  a  specialized  sniffer,"  Thomas  told  the  Journal,  which 
first  reported  details  about  Carnivore. 

Encrypted  e-mail,  done  with  an  e-mail  encoding  program  like  POP,  still 
stays  in  code  on  Carnivore,  and  it's  up  to  agents  to  decode  it. 

Dempsey  has  a  possible  solution  to  the  problem,  though  one  that’s 
probably  unlikely  —  show  everyone  what  it  does  and  how  it  does  it, 
allowing  internet  providers  to  install  the  software  themselves. 

"The  FBI  should  make  this  gizmo  an  open-source  product,"  he  said. 
"Then  the  secret  is  gone.” 


On  the  Net:  Federal  Bureau  of  Investigation:  http://www.fbi.gov 
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American  Civil  Liberties  Union:  http://wvAv.aclti.org 
Center  for  Democracy  and  Technology  :  http://wwwxdt.org 
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FBI’s  system  to  covertly  search 
e-mail  raises  privacy,  legal  issues 


By  Neil  King  Jr.  and  Ted  Bridis 


Washington,  j«3y  u  — The  U.S.  Federal  Bureau 
of  Investigation  is  using  a  superfast  system 
called  Carnivore  to  covertly  search  e-mails  for 
messages  from  criminal  suspects. 
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ESSENTIALLY  A  PERSONAL  COMPUTER 
stuffed  with  specialized  software.  Carnivore  represents 
a  new  twist  in  the  federal  government’s  fight  to  sustain 
its  snooping  powers  in  the  Internet  age.  But  in 
employing  the  system,  which  can  scan  millions  of 
e-mails  a  second,  the  FBI  has  upset  privacy  advocates 
and  some  in  the  computer  industry.  Experts  say  the 
system  opens  a  thicket  of  Unresolved  legal  issues  and 
privacy  concerns. 

The  FBI  developed  the  Internet  wiretapping  system 
at  a  special  agency  Sab  at  Quantico,  Va„  and  dubbed  it 
Carnivore  for  its  ability  to  get  to  “the  meat”  of  what 
would  otherwise  be  an  enormous  quantity  of  data.  FBI 
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Word  of  the 
Carnivore  system 
has  disturbed  many 
in  the  Internet 
industry  because, 
when  deployed,  it 
must  be  hooked 
directly  . into  Internet 
service  providers’ 
computer  networks. 


technicians  unveiled  the  system  to  a  roomful  of 
astonished  industry  specialists  here  two  weeks  ago  in 
order  to  steer  efforts  to  develop  standardized  ways  of 
complying  with  federal  wiretaps.  Federal  investigators 
say  they  have  used  Carnivore  in  fewer  than  100  criminal 
cases  since  its  launch  early  last  year. 

Word  of  the  Carnivore  system  has  disturbed  many 
in  the  Internet  industry  because,  when  deployed,  if  must 
be  hooked  directly  into  Internet  service  providers’ 
computer  networks.  That  would  give  the  government,  at 
least  theoretically,  the  ability  to  eavesdrop  on  al! 
customers'  digital  communications,  from  e-mail  to 
online  banking  and  Web  surfing. 

The  system  also  troubles  some  Internet  service 
providers,  who  are  loath  to  see  outside  software  plugged 
into  their  systems.  In  many  cases,  the  FBI  keeps  the 
secret  Carnivore  computer  system  in  a  locked  cage  on 
the  provider’s  premises,  w  ith  agents  making  daily  visits 
to  retrieve  the  data  captured  from  the  provider’s 
network.  But  legal  challenges  to  the  use  of  Carnivore 
arc  few,  and  judges’  rulings  remain  sealed  because  of 
the  secretive  nature  of  the  investigations. 

Internet  wiretaps  are  conducted  only  under  state  or 
federal  judicial  order,  and  occur  relatively  infrequently. 
The  huge  majority  of  wiretaps  continue  to  be  the 
traditional  telephone  variety,  though  U.S,  officials  say 
the  use  of  Internet  eavesdropping  is  growing  as 
everyone  from  drug  dealers  to  potential  terrorists  begins 
to  conduct  business  over  the  Web. 


Mews  from  the  WSJ 


Walt  Street  Journal 
stories  on  MSNBC 


1  he  rBI  defends 
Carnivore  as  more 
precise  than  Internet 
wiretap  methods  used  in 
the  past.  The  bureau 
says  the  system  a!  low's 
investigators  to  tailor  an 
intercept  operation  so  they  can  pluck  only  the  digital 
traffic  of  one  person  from  among  the  stream  of  millions 
of  other  messages.  An  earlier  version,  aptly  code-named 
Omnivore,  could  suck  in  as  much  as  to  six  gigabytes  of 
data  every  hour,  but  in  a  less  discriminating  fashion. 

Still,  critics  contend  that  Carnivore  is  open  to 
abuse. 


Mark  Rasch,  a  former  federal  computer-crimes 
prosecutor,  said  the  nature  of  the  surveillance  by 
Carnivore  raises  important  pri  vacy  questions,  since  it 
analyzes  part  of  every  snippet  of  data  traffic  that  flows 
past,  if  only  to  determine  whether  to  record  it  for  police. 
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“It’s  the  electronic 
equivalent  of 
listening  to 
everybody’s  phone 
calls  to  see  if  if  s  the 
phone  call  you 
should  be 
monitoring,”  Mr. 
Rasch  said.  “You 
develop  a 

tremendous  amount 
of  information.” 


“It’s  the  electronic  equivalent  of  listening  to 
everybody’s  phone  calls  to  see  if  it’s  the  phone  call  you 
should  be  monitoring,”  Mr.  Rasch  said.  “You  develop  & 
tremendous  amount  of  information.” 

Others  say  the  technology  dramatizes  how  far  the 
ration’s  laws  are  lagging  behind  the  technological 
revolution.  “This  is  a  clever  way  to  use  old 
telephone-era  statutes  to  meet  new  challenges,  but 
clearly  there  is  too  much  latitude  in  the  current  law  ” 
said  Stewart  Baker,  a  lawyer  specializing  in 
telecommunications  and  Internet  regulatory  matters. 

Robert  Coin  -Revere,  of  the  Hogan  &  Hanson  law 
firm  here,  represented  an  unidentified  Internet  service 
provider  in  one  of  the  few  legal  fights  against 
Carnivore.  He  said  his  client  worried  that  the  FBI  would 
have  access  to  all  the  e-mail  traffic  on  its  system,  raising 
dire  pri  vaev  and  security  concerns.  A  federal  magistrate 
ruled  against  the  company  early  this  year,  leaving  it  no 
option  but  to  allow  the  FBI  access  to  its  system. 

’This  is  an  area  in  desperate  need  of  clarification 
from  Congress  “  said  Mr.  Corn-Re  vere. 

“Once  the  software  is  applied  to  the  ISP,  there’s  no 
check  on  the  system,*'  said  Rep.  Bob  Barr  (R.,  Ga.), 
who  sits  on  a  House  judiciary  subcommittee  for 
constitutional  affairs.  “If  there’s  one  word  I  would  use 
to  describe  this,  it  would  be  'frightening.*” 

Marcus  Thomas,  chief  of  the  FBI's  Cyber 
Technology  Section  at  Quamieo,  said  Carnivore 
represents  the  bureau’s  effort  to  keep  abreast  of  rapid 
changes  in  Internet  communications  while  still  meeting 
the  rigid  demands  of  federal  wiretapping  statutes.  “This 
is  just  a  very  specialized  sniffer,'"  be  said. 

He  also  noted  that  criminal  and  civil  penalties 
prohibit  the  bureau  from  placing  unauthorized  wiretaps, 
and  any  information  gleaned  in  those  types  of  criminal 
cases  would  be  thrown  out  of  court.  Typical  Internet 
wiretaps  last  around  45  cays,  after  which  the  FBI 
remov  es  the  equipment,  Mr.  Thomas  said  the  bureau 
usually  has  as  many  as  20  Carnivore  systems  on  hand, 
“just  in  case.” 
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FBI  experts  acknowledge  that  Carnivore's 
monitoring  can  be  stymied  with  computer  data  such  as 
e-mail  that  is  scrambled  using  powerful  encryption 
technology.  Those  messages  still  can  be  captured,  but 
law  officers  trying  to  read  the  contents  are  “at  the  mercy 
of  how  well  it  was  encrypted  ”  Mr.  Thomas  said. 

Most  of  the  criminal  cases  where  the  FBI  used 
Carnivore  in  the  past  I  S  months  focused  on  what  the 
bureau  calls +t  infrastructure  protection  ”  or  the  hunt  for 
hackers,  though  it  also  was  used  m  counterterrorism  and 
some  drug-trafficking  cases. 
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News  Burst:  FBI  uses  covert  email  surveillance  system 


Tue,  11  Jul  2000  16:21:36  GMT 
Will  Knight 

A  super-fast  scanning  system  nicknamed  'Carnivore*  is  being  used  by  the  FBI 
to  covertly  search  through  email  messages,  says  the  Wall  Street  Journal 

America's  Federal  Bureau  of  Investigation  (FBI)  is  using  a  super-fast  email 
scanning  system  dubbed  "Carnivore”  to  covertly  trawl  through  email  messages 
in  order  to  capture  suspected  criminals,  reports  the  Wall  Street  Journal 
Tuesday. 


The  revelations  have  caused  a  furore  among  privacy  and  security  advocates, 
because  it  requires  a  direct  connection  to  a  commercial  ISP's  network, 
giving  the  authorities,  in  theory,  access  to  ail  Internet  communications. 

Carnivore  is  reportedly  nothing  more  than  a  personal  computer  fitted  with 
special  software  capable  of  scanning  millions  of  emails  in  a  second. 

According  to  the  WSJ's  report  Carnivore,  which  was  launched  last  year,  has 
been  used  to  gather  evidence  in  fewer  than  1 00  criminal  cases. 
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FBI  e-mail  Snooping  Device  Attacked 

I 

<  By  D.  IAN  HOPPER 

f  .c  The  Associated  Press 

WASHINGTON  (AP)  -  Civil  liberties  and  privacy  groups  are  railing  against  a  new  system 
designed  to  allow  law  enforcement  agents  to  intercept  and  analyze  huge  amounts  of  e-mail  in 
connection  with  an  investigation. 

The  system,  called  "Carnivore,”  was  first  hinted  at  on  April  6  in  testimony  to  a  House 
subcommittee.  Now  the  FBI  has  it  in  use. 

When  Carnivore  is  placed  at  an  Internet  sendee  provider,  it  scans  all  incoming  and  outgoing 
e-mails  for  messages  associated  with  the  target  of  a  criminal  probe. 

In  a  letter  addressed  to  two  members  of  the  House  subcommittee  that  deals  with  Fourth 
Amendment  search-and-setzure  issues,  the  American  Civil  Liberties  Union  argued  that  the 
system  breaches  the  Internet  provider's  rights  and  the  rights  of  all  its  customers  by  reading  both 
sender  and  recipient  addresses,  as  well  as  subject  lines  of  e-mails,  to  decide  whether  to  make  a 
copy  of  the  entire  message. 

Further,  while  the  system  is  plugged  into  the  Internet  provider's  systems,  it  is  controlled  solely  by 
the  law  enforcement  agency.  In  a  traditional  wiretap,  the  tap  is  physically  placed  and  maintained 
by  the  telephone  company. 

"Carnivore  is  roughly  equivalent  to  a  wiretap  capable  of  accessing  the  contents  of  the 
conversations  of  all  of  the  phone  company's  customers,  with  the  'assurance'  that  the  FBI  will 
record  only  conversations  of  the  specified  target,”  read  the  letter.  "This  ’trust  us,  vve  are  the 
government'  approach  is  the  antithesis  of  the  procedures  required  under  our  wiretapping  laws." 

Barry'  Steinhardt,  associate  director  of  the  ACLU,  said  citizens  shouldn't  trust  that  such  a 
sweeping  dala-tap  will  only  be  used  against  criminal  suspects.  And  even  then,  he  said,  the  data 
mined  by  Carnivore,  particularly  subject  lines,  are  already  intrusive. 

"Law  enforcement  should  be  prohibited  from  installing  any  device  that  allows  them  to  intercept 
communications  from  persons  other  than  the  target,"  Steinhardt  said  in  an  interview.  "When 
conducting  these  kinds  of  investigations,  the  information  should  be  restricted  to  only  addressing 
information," 

A  spokeswoman  for  Rep.  Charles  T.  Canady,  R-Fla.,  who  heads  the  House  Judiciary 
subcommittee  on  tire  Constitution,  said  the  congressman  had  no  comment  on  the  letter. 

In  testimony  to  Canady's  subcommittee,  Robert  Corn-Revere,  a  lawyer  at  the  Hogan  &  Hartson 
law  firm  in  Washington,  said  he  represented  an  Internet  provider  that  refused  to  install  the 
Carnivore  system.  The  provider  was  placed  in  an  "awkward  position,”  Corn-Revere  said, 
because  the  company  feared  suits  from  customers  unhappy  with  the  government  looking  into  all 
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"It  was  acknowledged  (by  the  government)  that  Carnivore  would  enable  remote  access  to  the 
ISP's  network  and  would  be  under  the  exclusive  control  of  government  agents,"  Com-Revere 
said. 

Com-Revere  told  the  committee  that  current  law  is  insufficient  to  deal  with  Carnivore’s  potential 
and  that  the  Internet  provider  lost  its  court  battle  in  part  because  of  the  Internet’s  connection  to 
telephone  lines,  and  that  the  law  was  stretched  to  cover  the  Internet  as  well. 

Com-Revere  would  not  reveal  the  name  of  his  client,  and  the  client  lost  the  case.  He  said  the  FBI 
has  been  using  Carnivore  since  early  this  year. 

James  X.  Dempsey,  senior  staff  counsel  at  the  Center  for  Democracy  and  Technology,  said  the 
main  problem  with  Carnivore  is  its  mystery. 

"The  FBI  is  p  lac  ing  a  black  box  inside  the  computer  network  of  an  ISP,"  Dempsey  said,  "Not 
even  the  ISP  knows  exactly  what  that  gizmo  is  doing." 


But  Dempsey  said  Internet  providers  contributed  to  the  problem,  by  saying  that  current 
technology  does  not  allow  the  Internet  provider  to  sort  out  exactly  what  the  government  is 
entitled  to  get  under  a  search  warrant.  The  carriers  complained  that  they  had  to  give  everything  to 
the  FBI. 

"The  service  providers  said  they  didn’t  know  how  to  comply  with  court  orders,”  Dempsey  said, 
"By  taking  that  position,  they  have  hurt  themselves,  putting  themselves  into  a  box." 


Marcus  Thomas,  who  heads  the  FBI’s  cyberteehnology  section,  told  the  Wail  Street  Journal  that 
the  bureau  has  about  20  Carnivore  systems,  which  are  PCs  with  proprietary  software.  He  said 
Carnivore  meets  current  wiretapping  laws,  but  is  designed  to  keep  up  with  the  Internet. 


"This  is  just  a  specialized  sniffer,"  Thomas  told  the  Journal,  which  fi  rst  reported  details  about 
Carnivore. 

Encrypted  e-mail,  done  with  an  e-mail  encoding  program  like  PGP,  still  stays  in  code  on 
Carnivore,  and  it’s  up  to  agents  to  decode  it, 

Dempsey  has  a  possible  solution  to  the  problem,  though  one  that’s  probably  unlikely  -  show 
everyone  what  it  does  and  how  it  does  it,  allowing  Internet  providers  to  install  the  software 
themselves. 

"The  FBI  should  make  this  gizmo  an  open-source  product,”  he  said.  "Then  the  secret  is  gone." 
On  the  Net:  Federal  Bureau  of  Investigation:  http://www.foi.gov 


American  Civil  Liberties  Union:  http://ww.aclu.org 
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FBI's  Internet  Wiretaps  Raise  Privacy  Concerns 

By  John  Sch  wartz 

Washingfon  Post  Staff  Writer  *  Privacy  Special  Report 

Tuesday,  July  1 1 1 2000;  Page  A01 


The  FBI  has  deployed  an  * 

automated  system  to  wiretap  the 

Interne^  giving  authorities  a  new  ^=?E-Mah  this  Artigt^ 

tool  to  police  cyberspace  but  ^  Prin^r-fdRp^ers^r, 

drawing  concerns  among  civil  '  . 

libertarians  and  privacy  advocates  about  how  it  might  be  used. 
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The  new  computer  system,  dubbed  "Carnivore"  inside  the  FBI  because  it  ff  « 
rapidly  finds  the  "meat"  in  vast  amounts  of  data,  was  developed  at  FBI  r 

computer  labs  in  Quarstico,  Va.,  and  has  been  used  in  fewer  than  50  . , 

cases  so  far  .  m~ 

But  that  number  is  sure  to  rise,  said  Marcus  Thomas,  chief  of  the  FBI’s  w  ><e  t 

cyber-technology  section  at  Quantico.  "In  criminal  situations  there's  not 
yet  been  a  large  call  for  it,"  he  said,  but  the  bureau  already  has  seen  f.rin 

"growth  in  the  rate  of  requests.”  *  ^ew 

Coun 

yu&ct. 

Civil  liberties  groups  said  the  new  system  raises  troubling  issues  about  jpdls. 

what  constitutes  a  reasonable  search  and  seizure  of  electronic  data,  in  iq-fr 

sniffing  out  potential  criminal  conduct,  the  new  technology  also  could 
scan  private  information  about  leeal  activities.  '  Tm£- 

Amo. 

^  Horn] 

*li  goes  to  the  heart  of  how  the  Fourth  Amendment  and  the  federal  gpM 

wiretap  statute  are  going  to  be  applied  in  the  Internet  age,"  said  Marc  «?<w 

Rotenberg,  head  of  the  Washington-based  Electronic  Privacy 
Information  Center.  Mars. 

New.. 

The  new'  system,  which  operates  on  off-the-shelf  personal  computers, 
takes  advantage  of  one  of  the  fundamental  principles  of  the  Internet:  that 
virtually  all  such  communications  are  broken  up  into  "packets,"  or 
uniform  chunks  of  data.  Computers  on  the  Internet  break  up  e-mail 
messages.  World  Wide  Web  site  traffic  and  other  information  into  pieces 
and  route  the  packets  across  the  global  network,  where  they  are 
reassembled  on  the  other  end. 

FBI  programmers  devised  a  "packet  sniffer"  system  that  can  analyze  data 
flowing  through  computer  networks  to  determine  whether  it  is  part  of  an 
e-mail  message  or  some  other  piece  of  Web  traffic.  mm%  Releaw  _  me  $33 
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The  ability  to  distinguish  between  packets  allows  law  enforcement 
officials  to  tailor  their  searches  so  that,  for  example,  they  can  examine  e- 
mail  but  leave  alone  a  suspect's  online  shopping  activities.  The  system 
could  be  tuned  to  do  as  little  as  monitoring  how  many  e-mail  messages 
the  suspect  sends  and  to  whom  they  are  addressed— the  equivalent  of  a 
telephone  "pen  register,"  which  takes  down  telephone  numbers  being 
called  without  grabbing  the  content  of  those  calls. 

“That’s  the  good  news,"  said  James  Dempsey,  an  analyst  with  the  Center 
for  Democracy  and  Technology,  a  Washington  high-tech  policy  group. 
“It  is  a  more  discriminating  device”  than  a  foil  wiretap,  he  said. 

But  Dempsey  expressed  worries  about  the  new  system,  which  would  be 
installed  at  the  offices  of  a  suspect's  Internet  service  provider.  Just  as  the 
device  could  be  used  to  fine-tune  a  search,  it  also  could  used  for  broad 
sweeps  of  data.  "The  bad  news  is  that  it's  a  black  box  the  government 
wants  to  insert  into  the  premises  of  a  service  provider.  Nobody  knows 
that  it  does  what  the  government  claims  it  would  do,"  Dempsey  said. 

Existence  of  the  Carnivore  system  was  discussed  in  a  Wall  Street 
Journal  article  yesterday,  which  reported  that  the  FBI  showed  the  system 
to  telecommunications  industry  experts  two  weeks  ago. 

Albert  Gidari,  a  lawyer  who  works  for  the  wireless  industry,  was  present 
at  the  FBI  demonstration.  He  said  the  FBI’s  announcement  was  intended 
to  counter  industry'  assertions  that  it  would  be  very  difficult  to  provide 
the  kind  of  pen-register  wiretap  capability  that  the  agency  wants. 

Since  the  demonstration,  Gidari  said,  one  faction  within 
telecommunications  industry  was  pleased  with  the  FBI's  efforts.  But 
Gidari  said  the  other  faction  was  saying:  "Wait  a  minute— what  are  the 
liability  issues?  What  are  the  privacy  issues?  We  don’t  want  third-part v 
software  on  our  system." 

Although  Congress  has  passed  legislation  requiring  telephone  companies 
to  make  their  developing  high-tech  networks  easy  to  wiretap,  Gidari  is 
one  of  a  large  number  of  industry  experts  who  believe  the  law  does  not 
apply  to  wiretapping  the  Internet,  "The  FBI  overreaches  in  everything 
they  do,"  said  Gidari,  who  is  president  of  G- Savvy,  an  Internet  * 
consulting  company. 

A  former  federal  prosecutor  sounded  a  more  supportive  tone.  “If  what  it 
does  is  it  helps  comply  with  wiretaps,  and  it  helps  minimize  what  you're 
getting— to  help  get  what  the  court  authorizes  you  to  get— there's  nothing 
wrong  with  it,"  said  Mark  Rasch,  now  a  security  consultant  with  Reston- 
based  Global  Integrity. 

Still,  Rasch  said  the  technology  raised  questions  that  have  yet  to  be  fully 
explored  by  law  enforcement.  The  PC  robocop  examines  all  packets 
coming  through  a  computer  network  but  gives  live  law  enforcement 
officers  only  those  packets  related  to  the  subject  of  the  investigation. 

"The  stuff  that  is  exami  ned  only  by  a  computer  and  not  by  a  human 
being— was  that  information  searched?”  Rasch  asked.  He  then  suggested 


http://w\vw.washingtonpost.comAvp-dyn/articles/A23986-2000 Ju!  1 1  .html 


5/24/02  Release  -  Page  03/ 
07/12/2000 


Internet  Wiretaps  Raise  P  '-acy  Concerns  (washingtonpost.com) 


Page  3  of 3 


an  answer:  "It  is  a  search,  but  it  is  to  an  extent  less  invasive  than  it  would 
be  it  you  dtd  not  use  this  technology." 

SfimSv  hv! \vf  ?m!VOrf  aCtuaIny  fame  5n  APril  durin8  congressional 
testimony  by  %.ashjn&£0«  lawyer  Robert  Corn-Revere,  who  represented 
an  internet  service  provider  that  tried  to  resist  attaching  the  system  to  its 
network.  Corn-Revere  suggested  that  such  a  system  could  be  used  to 
track  dissidents  and  journalists  online.  "There  are  some  human  rights 
issues  here,’ he  said.  b 

But  Thomas  of  the  FBI  said  there  is  nothing  mysterious  about  the  new 

ilt  wi  1  35  an.eff?rt  on  the  RBI’s  part  to  keep  pace  with  changes  in 

technology-to  maintain  our  ability"  to  lawfully  intercept  everything 
from  pen-register  data  to  Ml  wiretaps  with  court  authorization.  "It’s  not 

\4an^do"h?L?°rity’  ** doesn>t  Presem  8  change  of  volume  in 
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Get  credit  for  that  old  IBM  PC,  lapto 


BY  PAVLA  SHAHI  T mmiZ 

Federal  agencies  will  be  able  to  ob¬ 
tain  credit  toward  the  purchase 
of  new  IBM  Corp.  PCs  and  Up- 
tops  by  donating  their  old  computers  to 
charity  via  a  unique  governmentwide 
contract. 

The  Department  ofVeterans  Affairs 
Special  Services  office  and  the  Air  Force 
Medical  Logistics  Office  awarded  a  de-  \ 
centralized  blanket  purchase  agreement  j 
last  week  to  iGov.com,  an  online  com-  \ 
pmei  equipment  reseller,  that  would  ai-  • 
low  government  customers  to  receive  a 
trade-in  allowance  for  their  older  IBM  ? 


federal  agencies'  obsolete  systems  and 
deliver  them  to  charitable  organizations. 

Agencies  can  specify  a  charity  or  al¬ 
low  Gifts  In  Kind  to  choose  the  charity 
that  will  receive  the  computer  Gifts  In 
Kind's  Recycle  Technology  program, 
which  supplies  refurbished  computers 
to  needy  organizations,  has  donated 
about  20,000  computers  a  year  to  non- 
proOt  organizations  since  it  started  in 


1994,  said  Doug  McAllister,  Gifts  , 
Rmd*$  director  of  marketing  and  con 
munications,  "Computers  and  teehne 
am  high  on  the  needs  list  for  char 
tyC  McAllister  said. 

Responsibility  for  deleting  classify 
information  from  computer  hard  drN 
or  removing  the  ted  drives  themselve 
rests  with  the  agency  trading  In  th 
equipment,  Mack  said.  * 


equipment  at  the  tim  e  of  purchase. 

Agencies  could  receive  a  $300  credit 
fox  IBM  PCs  that  have  48b  or  faster 
processors  and  are  Year  toco-compliant, 
said  Connne  Lingebach.  IGov.coms  pro¬ 
gram  manager  for  the  Technical  Refresh 
and  Trade-In  program,  which  is  open  to 
all  government  agencies  and  runs 
rnrough  Oct.  Sv  200a.  The  credit  can  be 
applied  to  the  purchase  of  a  new  com¬ 
puter  Agencies  could  receive  a  $500  cred¬ 
it  for  each  laptop  turned  in. 

The  SPA,  based  on  iGov.coms  Gener¬ 
al  Sendees  Administration  schedule  con¬ 
tract,  “Is  a  better  value,  and  it  enhances 
programs  we  already  have/1  said  govern¬ 
ment  contracting  officer  Mary  Rust. 
"Only  iGov  offers  the  trade-in,  so  it's 
unique." 

The  contract  guarantees  iGov.com  at  I 
least  $500,000  in  sales,  but  the  company  I 
anticipates  more  than  $25  million  m  sales  I 
over  the  life  of  the  contract,  said  Brad  j 
Mack,  IGovconfs  vice  president  of  sales,  j 
In  the  future.  Rust  hopes  to  add  oth-  i 
er  types  of  compu  ter  equipment  to  the  I 
program.  Although  there  are  no  other  j 
contracts  that  offer  trade-in  credits,  j 
Rust's  office  does  offer  other  unique 
programs  that  benefit  schools  and  oth¬ 
er  charities. 

IGov.com  partnered  with  Gifts  In 
Kind  International,  an  Alexandria,  Va,~ 
based  charity  organization,  to  refurbish 

JO  $  tf  L  Y  I  ?  ,  }  O  ft  A 


ACLU:  Block  FBI  e-snoops 


j  BV  DAM  V£RTON 

The  American  Civil  Liberties 
Union  appealed  to  Congress  last 
week  10  protect  America  ns  f fom 
I  unreasonable  searches  and  seizures  on 
5  Internet  in  light  of  recent  revela  tions 

;  that  3  new  monitoring  tool  could  enable 
;  the  FBI  to  intercept  the  e-mail  of  law- 
abiding  citizens, 

!:  In  3  letter  to  the 
j  House  Judiciary  Com- 
1  mittee's  Constitution 
|  Subcommittee  ACLU 
■  director  Laura  Mur- 
l  phy  argued  that  the 
l  -  new  Carnivore  e-mail  surveillance 
j  system  gives  federal  law  enforcement  of- 
\  access  to  the  e-mail  of  every  cos- 

I  turner  of  an  Internet  service  provider  and  ] 

the  e-mad  of  every  person  who  commu  ¬ 
nicates  with  them, 

Tht  Carnivore  system  gives  law  en¬ 
forcement  e-mail  interception  capabili¬ 
ties  that  were  never  contemplated  when 
Congress  passed  the  Electronic  Com¬ 
munications  Privacy  Act”  in  1986,  Mur¬ 
phy  stated  in  die  letter.  “The  ACLU  urges 
the  subcommittee  to  accelerate  its  com  I 
slderarion  of  the  application  of  the 
Fourth  Amendment  in  the  Digital  Age,” 
The  Fourth  Amendment  to  the  Con-  ; 
sritution  protects  the  public  from  un¬ 
reasonable  searches  and  seizures.  ; 

Attorney  General  Janet  Reno  said  July 


j  13  that  she  is  now  looking  Into  the  alle 
>  gations.  "When  we  develop  new  tech 
|  mlm\  when  we  apply  the  Consrimrioit 
I  3  want  to  make  sure  that  we  apply  it  in 
|  3  consistent  and  balanced  way”  Rene 
j  said, 

Robert  Corn- Revere,  an  Internet  and 
*  communica  dons  lawyer  with  the  Wash¬ 
ington,  DX. -based 
law  firm  Hogan  & 
Barston  LLP,  first  di¬ 
vulged  evidence  of 
?  tke  Carnivore  sys¬ 
tem's  abilities  during 
a  congressional  hear- 
j  April  The  FBI  mus  t  have  a  court 
|  enter  to  use  Carnivore, 
j  ^nce  approved,  Carnivore  is  attached 
directly  to  an  ISP's  network  and  gives 
the  FBI  access  to  ail  e-mail  traffic  flow¬ 
ing  across  the  network,  according  to  the 
:  ACLU,  The  ACLU  and  others  have  raised 
concerns  that  Carnivore  intercepts  in¬ 
formation  from  the  header's  of  e-mail 
messages  and  may  divulge  derails  about 
the  contents  of  the  messages. 

The  FBI  and  the  law'  enforcement  . 
and  national  security  communities  in 
general  are  offering  a  trade:  less  privacy 
due  to  increased  use  of  technology  in  sur¬ 
veillance  In  return  for  greater  safety  for 
the  public/'  said  Daniel  Ryan,  a  lawyer 
and  former  director  of  Information  Sys¬ 
tems  Security  at  the  Pentagon, » 
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Intel!  turf  battles  rage 


by  cm  VERTOV  j  about  the  impact  the  new  office  might 

Major  portions  of  a  hill  that  j  have  on  DOD's  efforts  to  orchestrate  a 
wom  authorize  appropriations  J  Global  information  Grid  (GIG),  accord- 
for  the  US,  intelligence  com-  I  mo  m  the  Cnhon  *nA  w*v  *ru» 


if  I  for  the  US,  intelligence  com¬ 
munity  would  significantly  limit  the  De¬ 
fense  Department's  ability  to  support 
military  operations,  warn 
Defense  Secretary  William 
Cohen  and  his  top  military 
adviser. 

Cohen  and  Army  Gen. 

Henry  Shel  ton,  chairman  of 
the  Joint  Chiefs  of  Staff  re¬ 
cently  sent  a  tetter  to  senior 
lawmakers  on  Capitol  Hill 
protesting  a  proposal  by  the 
House  Permanent  Select 
Committee  on  Intelligence 
to  establish  an  intelligence  M 

community'  communications  Secretary  < 
architect  position  within  the  Cl  A.  The 
chief  architect  would  have  broad  re¬ 
sponsibilities  for  the  development  of  a 
worldwide  telecommunications  system 
that  would  serve  the  intelligence  com¬ 
munity ,  the  bu  l  k  of  which  now  resides 
in  BOD  and  not  the  CIA, 

The  chief  architect,  supported  by  a  30- 
person  staff  would  be  funded  with 
million  in  start-up  money  taken  direct¬ 
ly  from  the  budgets  of  the  Pentagons  Na¬ 
tional  Reconnaissance  Office,  the  Na¬ 
tional  Security  Agency  and  the  Defease 
Intelligence  Agency;  seconding  to  the  bill 
“Tins  unilateral  and  independent  ar¬ 
chitectural  office  would  seriously  dam¬ 
age,  if  not  totally  destroy  the  efforts  of  | 


jence  com-  tag  to  the  Cohen  and  Shelton  letter.  The 
m  the  Be-  :  Pentagon  has  been  working  on  the  GIG 
to  support  concept  for  more  than  a  year  and  envi¬ 
sions  a  global  network  capa¬ 
ble  of  deli  vering  secure  in¬ 
formation  to  all  users. 

The  GIG  anhitemire  splits 
a  premium  on  the  assured 
and  timely  access  by  our 
warfighters  and  policy-mak¬ 
ers  to  all  forms  of  informa¬ 
tion,  including  intelligence^ 
a  Pentagon  spokesperson 
said  However/'ihere  should¬ 
n't  be  separate  architecmres 
Cohen*  for  combat  functions,  for 

Sec  W  of  Defence  suppofi  fmeti^  [or|  forta. 

Cl  A.  The  |  telligence  functions.  Otherwise,  we're 
broad  re-  $  back  at  the  srovepiped,  stand-alone  $ys- 
merit  of  a  ?■  terns  that  don't  talk  to  one  another  in  a 
r*$  system  j  timely  fashion" 
mce  com-  j  An  official  from  the  Pentagon's  office 
w  resides  j  oi  Command,  Control,  Conurrunications 
|  and  Intelligence  also  said  that  the  Pen- 
d  by  a  30-  :  tagon  supports  a  broader  GIG  concept  as 
with  $80  j  opposed  to  a  narrow;  Intel  iigence-only 
5X1  direct-  j  communications  architecture. 

igons  Na-  j  r“““~  — — — - — “~ 

the  Ns-  I  A  WAR,  NOT  A  BATTLE 

-  Defense  j  intelligence  experts  characterized  the 
0  the  bill  j  latest  report  m  the  bill  from  the  House 
ndentar-  ?  Armed  Services  Committee  m  little  more 
isly  dam-  than  a  tool  in  the  struggle  for  control 
efforts  of  j  |  over  the  Intelligence  budget  between  the 


the  DOD  chief  information  officer,  who  j  j  House  and  t  he  Senate  Select  Committee 
has  ongoing  activities  with  the  flntellte  |  on  intelligence,  chaired  by  Sen,  Richard 


genee  community]  and  Defense  Intelli¬ 
gence  component  CIOs  to  ad  vance  In¬ 
teroperability  between  and  among 
intelligence  producers  and  consumers,” 
Cohen  and  Shelton  told  Congress.  The 
House  Armed  Services  Committee  In¬ 
cluded  Cohen  and  Shelton's  tetter  in  a  re¬ 
port  on  the  fiscal  2001  Intelligence  Au¬ 
thorization  hill,  released  last  month. 

But  the  Pentagon  is  also  concerned 

f  t'PISAl  COMFOTER  W  £  £  K 


Others  said  the  debate  canters  m  the 
larger  questions  of  reforming  the  intelii- 
aaoce  community  and  who  should  be  in 
chsrge;  ^  ;y -  • 

-It  just  one  more  Instance  of  the  turf 
battle  over  Intelligence^  said  Steven 
Aftergood,  an  intelligence  specialist  with 
t  he  Federation  of  American  Scientists, 


'"Solutions  which  take  down  the  old 
barriers  to  Interoperability  and  harness 
I  our  collaborative  networking  and  com¬ 
puting  capabilities  have  the  most  value 
E  :  and  are  deserving  of  support  ”  the  off*- 
i  dal  said.  "Our  concerns  with  the  pro 
*  I  posed  intelligence  communications  or- 

■  chitect  are  lessened  by  the  extent  to 
!  which  that  entity  is  free  to  support  the 

■  j  broader  Global  Information  Grid  archi- 
|  teernre  In  preference  to  a  narrower,  in- 
|  telllgence-only  network  ” 

I  Cohen  and  Shelton  expressed  opposi- 
j  tion  to  Congress"  proposal  to  expedite 
]  the  real-world  use  of  the  Joint  IntelU- 
|  genre  Virtual  Ajclutecrure  tool  in  the  m* 
j  telligence  community,  saying  it  is  "pre- 
;  mature”  to  designate  the  software 
j  capability  as  the  community  standard 
i  for  collaboration.  The  program  is  a  next- 
|  generation  digital  collaboration  effort 
|  headed  up  by  Defense  Intelligence 
i  Agency.  Congress  called  fororersteht  of 

t  -  c? 

j  the  program  to  be  transferred  from  DOD 
|  to  the  CIA, 

|  ”We  feel  strongly  that  it  would  be 
j  counter productive  both  to  prohibit  fur- 
|  ^,<?r  non  }1VA  technology  pursuits  and 
j  to  remove  the  program  from  the  BCD 
j  oversight  that  has  made  It  the  success 
l  that  the  committee  commends/'  stated 
]  Cohen  and  Shelton 
I  The  CIA  deck ned  to  comme m  on  the 

I  proposed  legislation.  * 

-'The  basic  question  \ $t  will  there  be  $  l 

strong  director  of  central  Intelligence 
who  fa  in  charge  of  the  whole  communi¬ 
ty?  The  Defense  Department  says  no" 
Furthermore,  "because  of  the  ongoing 
militarization  of  Intelligence,  my  bet  is  that  : 
the  Pentagon  will  get  its  way,"  he  said,  j 

Robert  Steele,  a  2  5 -year  veteran  of  t  he  j 

intelligence  community  and  author  of  the 
recent  book  “On  intelligence;  Spies  and 
Secrecy  In  an  Open  World,"  said  t  he  infor¬ 
mation  Age  has  challenged  t  he  whole  no¬ 
tion  of  having  a  cent  ral  agency  responsible 
for  intelligence.  *tn  the  age  of  distributed 
information,  the  concept  of  central  Intelli¬ 
gence  Is  an  oxymoron,"  Steele  said, 

-  Dan  Verier* 

...  . . . . — . . . 


5/24/02  Release  -  Page  b 


.FBI  e-mail  Snooping  Device  At"  Ved 


Page  I  of 


lOMoalNEWS^  Ap  £f|°c 


L#i?*?oLPfel^HinV^  :  2,9%  APR  -  Instant  Credit  -  Rewards  with 
GiitCertificates.com  ~  No  Annua!  Fee. 


«2JM.  iPPStories  Business  Tech  Politics  World  local  Entertainment  Spot 

Politics  News  -  updated  7:1?  AM  ET  Jut  12 
B.#yters  f  AP  {  Elections  J  ABCNews 
Tuesday  July  II  7:26  PM  ET 

FBI  e-mail  Snooping  Device  Attacked 

By  £>  IAN  HOPPER,  Associated  Press  Wr  iter 

WASHINGTON  (AP)  -  Civil  liberties  and  privacy  groups  railed 
Tuesday  against  a  new  system  designed  to  allow  law  enforcement  asents 
to  intercept  and  analyze  huge  amounts  of  e-mail  in  connection  with  an 
investigation. 
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N^w  £  FsSit  iifusr0'^" ^  Wnlcd  at  00  April  6  5n  Alimony  to  a  House  subcommittee. 
When  Carnivore  is  placed  at  an  Internet  Sendee  Provider,  it  scans  all  incoming  and  outcome  P  f 

messages  associated  with  the  target  ofa  criminal  probe.  mcor.i.n^  ana  outgoing  e-mails  t 

In  a  letter  addressed  to  two  members  of  the  House  subcommittee  that  deals  with  Fourth  Amendment 

SSfSnffi/'T  p}?! LibMiK  «*«l  that  .he  “S LaSX te 

LSefS  w2i  asfuht^lf  !  nf  °f -f  llS  $usU?mcrs  b>'  readinS  both  sender  and  recipient 
addresses,  as  well  as  subjvci  Hues  of  e-mails,  to  decide  whether  to  make  a  copy  of  the  entire  message. , 

Further,  while  the  system  is  plugged  into  the  Internet  provider’s  systems,  it  is  controlled  soieiv  hv  ih* 

*  tr3dhi0na3  Wirm?’ the  tap  i8  ph'VsicaIJ>'  #***«  and  ntaimabed  by  the16 

Camuore  is  roughly  equivalent  to  a  vviretap  capable  of  accessing  the  contents  of  the  conversation*.  nf 

llK '»“'  that  the  FBI  vSuKi  Sv  comSSns 

.,  y  T  lar§et»,  rta(l !,IC  icu.r.  This  ’trust  us,  vie  are  the  government’  approach  is  the  antithesis  o 
the  procedures  required  under  our  wiretapping  laws.”  H  anmness*  o 

Barry  Steinhardt,  associate  director  oi  the  ACLU,  said  citizens  shouldn't  trust  that  such  a  sweeninr  dat 
tap  will  only  be  used  against  criminal  suspects.  And  even  then,  he  said  the  data  mined  bv ffiT 
particularly  subject  lines,  is  already  intrusive.  b>  Canuvore’ 

"Law  enforcement  should  be  prohibited  from  installing  any  device  that  allows  them  to  intercom 
communications  from  persons  other  than  the  target,”  Steinhardt  said  in  an  interview  "  When  conductm 
these  kinds  of  investigations,  the  information  should  be  restricted  to  only  addressing  initiation'' 

tout. ZZfil’lX  C“K  b  Cma<ly'  R'Fla  ’ whD  «»  Constitution  subcommittee,  said 

mat  the  congressman  had  no  immediate  comment  on  the  letter 
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from  customers  nniianm*  «*Tti  ™u  ^u  wl .  wKn-Kevwe  saw,  because  the  company  feared  sui 

irom  customers  unhappy  vvuh  the  government  looking  m  to  all  the  e-mail. 

kT°Wi  mSu  d  (b'I  ih^ovcmtnml)  that  Carnivore  would  enable  remote  access  to  the  ISP's 
nattorh  and  would  be  under  the  exclusive  control  of  government  agents,"  Com-Revere  said. 

She^  ?h2t  curflt!3 ^ is  Sufficient  to  deal  with  Carnivore's  potential  and 

SScTn?  S1P 7  d  Iost  the“rfUrt  battie  in  Part  because  of  the  Internet’s  connection  to  telephone 
lines,  and  that  the  law  was  stretched  to  cover  the  Internet  as  well.  10  luePftone 

Com-Revere  would  not  reveal  the  name  of  his  client,  and  the  client  lost  the  case.  He  said  that  the  FBI 
has  been  using  Carnivore  since  early  this  year.  uut  me  t  li  1 

5rp»bfrSc™“o®f  rf  Cem“  f0r  Dmcy  °nd  Ted™lo»'-  «*  the 

0f  2" IS1V' Dcraps£y  said-  "Na  «*> * 

But  Dempsey  said  that  Internet  providers  contributed  to  the  problem,  bv  savins  that  current  tecWo<r 
does  not  allow  the  Internet  provider  to  sort  out  exactly  what  the  government  is'entitled  to  ee<  u^S7 
search  warrant  1  he  earners  complained  that  they  had  to  give  everything  to  the  FBI.  “  fe 

The  sendee  providers  said  they  didn't  know-  how  to  comply  with  court  orders  "  D'-moscv  «•«*{*»  ”pv 
taking  that  position,  they  have  hurt  themselves,  putting  themselves  into  a  box  "  *J> 

buSuSh5°S  Sr!? the  FBI  s  Cyber  Technology  Section,  told  the  Wall  Street  Journal  that  the 
bureau  has  about  ^0  Carnivore  systems,  which  are  PCs  with  proprietary  software.  He  said  C^ntonre 
meets  current  wiretapping  laws,  but  is  designed  to  keep  up  with  the  Internet, 

cStooreUSt  “  Spedalized  SiliiTer*” Thomas  io!d  «»  Journal,  which  first  reported  details  about 

iftup1 to  a£™to  feSfef  “  e'm,il  ""*«  program  like  POP,  still  slays  it,  code  on  Carnivore,  an 

Dempsey  has  a  possible  solution  to  the  problem,  though  one  that's  probably  unlikely  -  show  everyone 
what  it  does  and  how  it  does  it,  allowing  Internet  providers  to  install  the  software  themse?ves 


The  FBI  should  make  this  gizmo  an  open-source  product,"  he  said.  "Then  the  secret  i 


is  gone. 
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Reno  to  review  the  FBI's  Internet  wiretap  system 

WASHINGTON,  July  13  (Reuters)  -  US.  Attorney  General  Janet  Reno  said  on  Thursday  she 
would  review  a  new  FBI  automated  computer  system  that  can  wiretap  the  Internet  to  determine 
whether  it  might  infringe  on  privacy  rights. 

"I'm  taking  a  took  at  it  now  to  make  sure  that  we  balance  the  rights  of  all  Americans  with  the 
technology  of  today,’’  Reno  said  when  asked  about  the  FBI  system  known  as '  'Carnivore"  that 
can  be  used  to  monitor  all  e-mails  of  a  criminal  suspect. 

Reno  emphasised  that  any  such  wiretaps,  which  are  placed  on  an  Internet  sendee  provider's 
system,  cannot  be  be  done  without  an  appropriate  court  order  "according  to  processes  and 
procedures  used  now  for  lawful  surveillance.” 

"We  are  looking  at  it  to  see  what  is  needed,  if  anything,”  she  said.  "If  additional  regulations  are 
needed,  we  will  pursue  those,” 

She  fold  her  weekly  news  briefing  that  she  wanted  to  make  sure  that  the  new  technology  doss  not 
become  "a  cause  of  concern  for  privacy  interests." 


The  American  Civil  Liberties  Union  (ACLU)  and  other  privacy  advocates  have  expressed 
concern  the  new  system  could  scan  private  information  about  legal  activities,  resulting  in 
excessive  monitoring  of  online  commumcal  ions.  Besides  e-mails,  she  system  can  monitor  visits 
to  Web  sites  and  Internet  chat  sessions. 


Reno  said  she  only  began  looking  into  the  issue  and  asking  questions  after  news  articles  appeared 
earlier  this  week.  The  FBI  recently  demonstrated  the  system  to  executives  in  the 
telecommunications  industry. 

"We  have  known  about  the  capacity  to  do  this.  Its  application  and  what  has  been  done  had  not 
been  brought  to  my  attention, ”  Reno  said. 


The  FBI’s  director,  Louis  Freeh,  reports  to  Reno. 

"1  just  wunt  to  make  sure  that  industry,  privacy  interests,  law  enforcement  interests  are  all  fully 
advised  so  that  we  can  consider  anybody’s  concerns  and  make  sure  that  we  address  them,”  Reno 
said. 

She  was  unable,  to  say  whether  the  system  would  continue  to  operate  until  her  review  was 
underway. 

13:29  07-13-00 

Copyright  2000  Reuters  Limited.  All  rights  reserved. 
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Controls  on  Export  of  Encryption  Software  to  be 
Eased 


By  John  Schwartz 
Washington  Post  Staff  Writer 
Monday,  July  17,  2000;  1:12  PM 

The  Clinton  administration 
announced  today  that  it  will 
loosen  controls  on  the  export  of 
encryption  software  -  the 
programs  that  help  users 
scramble  messages  and  data  to 
protect  it  from  prying  eyes  -  and 
called  for  new  legislation  intended 
to  make  sense  of  wiretapping  in 
the  Internet  age. 


""-—"""Uve  Onlme— 

*  David  Steer 

of  TRUSTe  discusses  how  to  protect 
sensitive  personal  information  at  1 1 
<:.m,  Wednesday. 

Protect  Your  Kids;  Amy  Aldmsn  of 
the  Center  for  Media  Education 
discusses  ways  to  protect  you 
children  online  at  1  p.m,  Thursday, 
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What' s  Vo or  Op i n ion? 

"We  need  to  seek  a  better  balance  g-nasi  this  Article 

amongst  the  sometimes  Prmter-Fngnriiv  Version 

competing  goals  of  the  protection 

of  public  safety,  the  achievement  of  economic  growth  and  digital 
opportunity  -  and  the  preservation  of  privacy  and  civil  liberties,"  said 
White  House  Chief  of  Staff  John  Podesta  in  a  speech  delivered  today  at 
the  National  Press  Club. 

Under  the  new  policy,  American  companies  will  be  able  to  export  the 
strongest  cryptography  products  to  users  in  any  nation  in  the  European 
Union  and  to  Australia,  Norway,  the  Czech  Republic,  Hungary',  Poland, 
Japan,  New  Zealand  and  Switzerland.  The  government  will  eliminate  a 
current  statutory  30-day  waiting  period  before  such  exports  can  take 
place,  but  keeps  in  place  a  requirement  that  new  technologies  be 
submitted  to  the  government  for  a  technical  review. 

Encryption  has  been  a  high-tech  battlefield  from  the  early  days  of  the 
Clinton  administration.  Few  technologies  are  as  important  in  the  fight  to 
maintain  persona!  and  business  privacy  -  hut  few  technologies,  as  well, 
present  such  daunting  issues  for  law  enforcement,  which  warns  that 
criminals  and  terrorists  can  use  “crypto”  to  cloak  their  plans  and 
activities.  But  high-tech  companies  successfully  argued  that  U.S, 
restrictions  only  harmed  American  companies,  since  overseas  firms 
were  successfully  marketing  strong  encryption  products,  and  in  January 
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today's  speech,  Podesta  stressed  tire  cow-familiar  theme  that  the  online 
revolution  has  been  a  mixed  hiessing.  At  the  same  time  that  the  Internet 
makes  Shakespearean  sonnets  and  new  photos  of  Mars  available 
anywhere  in  the  world,  it  has  undermined  the  pirvacy  of  our  most 
sensitive  financial  and  medical  records,  and  allows  such  evildoers  as 
international  drug  traffickers  to  communicate  freely  and  secretly. 

"That's  why  we  have  to  make  sure  the  Internet  is  used  to  the  benefit  of 
people  -  not  to  their  detriment,"  the  Podesta  said. 


The  most  sweeping  part  of  the  Podesta  address  was  a  call  for  a  thorough 
rethinking  of  the  Fourth  Amendment’s  protection  against  unreasonable 
search  and  seizure  in  the  Internet  age.  Electronic  mail  transmitted  by 
high-speed  connections  such  as  DSL  modems,  Podesta's  speech  argued, 
has  never  enjoyed  the  legal  protections  the  law  gives  to  telephone 
conversations  -  or  to  slower  dial-up  modems  under  the  Electronic 
Privacy  Communications  Act  of  1984.  At  the  same  time,  cable  privacy 
laws  are  tougher  than  wiretap  standards  when  it  comes  to  gaining  access 
to  subscriber  records  ~  which  could  include  e-mail  sent  via  cable 
modem.  Podesta  called  for  new  legislation  to  address  the  inconsistencies 
in  the  legal  framework.  "It’s  time  to  adopt  legislative  protections  that 
map  these  important  privacy  principles  onto  the  latest  technology,"  he 
said. 


Podesta's  speech  also  make  oblique  reference  to  a  controversial  new 
surveillance  technology  revealed  last  week,  which  is  known  as 


"Carnivore."  Carnivore  gives  government  the  ability  to  selectively 
monitor  Internet  traffic  of  individuals  in  ways  that  can  give  law- 
enforcement  the  Internet  equivalent  of  "trap  and  trace"  capabilities  used 
in  telephone  surveillance.  Unlike  full-fledged  wiretaps,  the  judicial 
oversight  of  trap  and  trace  is  slight,  and  the  protection  against  abuses  of 
the  technology  fay  law  enforcement  is  weak.  Podesta  called  for  "greater 
judicial  oversight  of  trap  and  trace  authorities." 


Podesta's  speech  stated  that  this  legislation  could  be  passed  by  the  end  of 
the  year  -  an  unlikely  prospect  in  these  waning  days  of  the  legislative 
session.  "It's  time  to  update  and  harmonize  our  existing  laws  to  give  all 
forms  of  technology  the  same  l  egislati  ve  protections  as  our  telephone 
conversations,”  he  said. 


The  speech  also  made  the  point  that  the  administration's  preference  is 
for  public-private  partnerships  to  make  the  Internet  secure  against 
attack,  but  noted  that  Congress  has  not  appropriated  any  of  the  $90 
million  President  Clinton  has  requested  for  security  research  and  cyber 
policing.  "It’s  time,"  Podesta  noted,  that  "they  picked  up  the  pace  and 
provided  the  protections  that  are  essential  to  America's  cyber  security.," 


The  speech  was  not  well  received  by  civil  liberties  advocates,  who  have 
fought  Carnivore  and  other  administration  attempts  to  develop 
wiretapping  capabilities  on  the  Internet,  Barry  Steinhardt,  associate 
director  of  the  American  Civil  Liberties  Union,  called  the  speech 
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"deeply  disappointing." 

Rather  than  defending  Carnivore,  Steinhardt  said,  Fodesta  should  have 
announced  that  the  administration  was  suspending  its  use.  "Carnivore 
represents  a  grave  threat  to  the  pri  vacy  of  all  Americans  by  giving  law 
enforcement  agencies  unsupervised  access  to  s  nearly  unlimited  amount 
of  communications  traffic,"  Steinhardt  said  in  a  statement. 

’’While  tlie  Clinton  administration's  proposals  have  some  heartening 
qualities  to  them,  they  are  too  tittle  and  too  late,’’  with  too  little  time  in 
the  legislative  session  to  pass  new  bills.  "Last-minute  legislative 
proposals  cannot  satisfy'  the  deep  privacy  concerns  of  the  American 
public,"  Steinhardt  said. 

©  2000  The  Washington  Post  Company 
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Proposal  Offers  Surveillance  Rules  for  the 
Internet 

White  House  Tries  to  Balance  Rights  of  Computer  Users 
and  Law  Enforcement 


By  STEPHEN  LABATON  with  MATT  RJCHTEL 

WASHINGTON,  July  17  -  The  White 
House  said  today  that  it  would  propose 
legislation  to  set  legal  requirements  for 
surveillance  in  cyberspace  by  law  enforcement 
authorities  similar  in  some  ways  to  those  for 
telephone  wiretaps. 

Privacy  advocates  and  civil  liberties  groups 
welcomed  some  aspects  of  the  proposal  but 
said  they  remained  alarmed  about  a  new  F.B.l. 
computer  system  that  searches  and  intercepts 
private  e-mail  and  can  easily  capture 
communications  of  people  not  suspected  of 
crimes. 

The  legislati  ve  proposal  was  made  as  the 
administration  also  announced  today  that  it  had 
eased  export  controls  on  encryption  technology, 
making  it  significantly  easier  for  American 
companies  to  sell  software  products  to  the 
European  Union  and  eight  other  trading 
partners  that  can  be  used  to  keep  computer  data 
and  communications  secure. 

Both  the  electronic  surveillance  proposal  and 
the  export  control  changes  are  part  of  a  broader 
policy  outlined  in  a  speech  today  by  John  D. 
Podesta,  the  White  House  chief  of  staff.  He  said 
the  policy  tries  to  balance  the  privacy  rights  of 
computer  users  against  the  needs  of  law 
enforcement  to  be  able  to  monitor  digital 
communications. 
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Congress  and  federal  regulators  have  done  little  work  in  the  area, 
even  as  the  world  has  quickly  come  to  rely  heavily  on 
communications  through  cyberspace-.  More  than  1 ,4  billion  e-mail 
messages  change  hands  every  day. 

The  administration's  legislative  proposal  on  electronic  surveillance 
tries  to  fix  the  inconsistent  patchwork  of  laws  that  apply  different 
standards  to  telephone,  cable  and  other  technologies  with  a  single 
standard  for  those  systems  and  the  Internet.  Prospects  for  the 
proposal  in  Congress  are  uncertain. 

Until  now,  law  enforcement  agencies  have  been  able  to  monitor 
electronic  communication  with  only  modest  court  supervision. 

The  proposed  legislation  would  require  that  the  same  standards  that 
apply  to  the  interception  of  the  content  of  telephone  calls  apply  to 
the  interception  of  e-mail  messages.  Specifically,  it  would  require 
law  enforcement  agents  to  demonstrate  that  they  have  probable 
cause  of  a  crime  to  obtain  a  court  order  seeking  the  contents  of  a 
suspect's  e-mail  messages. 

The  proposal  would  also  give  federal  magistrates  greater  authority 
to  review  requests  by  law  enforcement  authorities  for  so-called  pen 
registers  —  lists  of  the  phone  numbers  called  from  a  particular 
location  and  the  time  of  the  calls.  The  magistrates  now  have  no 
authority  to  question  the  request  for  such  lists,  which  are  frequently 
used  by  the  authorities. 

In  the  context  of  the  Internet,  existing  laws  are  ambiguous  about 
what  standards  apply  for  different  kinds  of  surveillance.  Many 
limitations  imposed  on  law  enforcement  in  the  con  text  of  telephone 
wiretaps  —  like  the  requirement  that  such  taps  be  approved  at  the 
highest  level  of  the  Justice  Department  —  do  not  appear  to  apply  to 
e-mail  surveillance. 

Moreover,  the  Cable  Act  of  1984  sets  a  far  harder  burden  for 
government  agents  to  satisfy  when  trying  to  monitor  computers 
using  cable  modems  than  when  monitoring  telephones.  That  has 
proved  troublesome  for  law  enforcement  authorities  as  more 
Americans  begin  to  use  high-speed  Internet  service  through  cable 
networks.  The  Cable  Ac  t  also  requi  res  that  the  target  of  the 
surveillance  be  given  notice  and  an  opportunity  to  challenge  the 
request. 

"It’s  time  to  update  and  harmonize  our  existing  law's  to  give  all 
forms  of  technology  the  same  legislative  protections  as  our 
telephone  conversations,"  Mr.  Podesta  said  in  a  speech  at  the 
National  Press  Club.  "Our  proposed  legislation  would  harmonize  tire 
legal  standards  that  apply  to  law  enforcement's  access  to  e-mails, 
telephone  calls  and  cable  services." 

White  House  officials  said  today  that  they  hoped  the  proposal  would 
break  a  logjam  in  Congress  where  a  variety  of  different  measures 
have  been  introduced  dealing  with  electronic  surveillance.  The 
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admi  nistration's  proposal  adopts  some  elemen  ts  of  both  Democratic 
and  Republican  bills. 

But  Congressional  aides  said  there  was  too  little  time  left  in  the 
legislative  session  and  that  the  matter  would  in  all  likelihood  remain 
f"  unresolved  until  after  the  next  term  begins,  in  2001 , 

_  t. 

Administration  officials  said  the  proposal  would  apply  to 
communications  that  either  begin  or  end  in  the  United  States.  It 
would  not  apply  to  e-mail  messages  transmitted  entirely  outside  the 
country. 

Privacy  and  civil  liberties  groups  criticized  the  administration's 
proposal  because  it  would  continue  to  permit  the  government  to  use 
a  new  surveillance  system  that  the  groups  say  may  be  used  far  more 
broadly  than  older  technologies,  enabling  federal  agents  to  monitor 
an  unlimited  amount  of  innocent  communications,  including  those 
of  people  who  are  not  targets  of  criminal  investigations. 

The  system,  used  by  the  Federal  Bureau  of  Investigation,  is  called 
Carnivore,  so  named,  agents  sav,  because  it  is  able  to  quickly  get  the 
"meat”  in  huge  quantities  of  e-mail  messages,  so-called  instant 
messaging  and  other  communications  between  computers. 

Carnivore  is  housed  in  a  small  black  box  and  consists  of  hardware 
and  software  that  trolls  for  information  after  being  connected  to  the 
network  of  an  Internet  service  provider.  Once  installed,  it  has  the 
ability  to  monitor  all  of  the  e-mail  on  a  network,  from  the  list  of 
what  mail  is  sent  to  the  actual  content  of  the  communications. 

Marcus  C>  Thomas,  section  chie  f  of  the  Cyber  Technology  Section 
of  the  F.BX,  said  the  technology  was  developed  5  8  months  ago  by 
F.B.l.  engineers  and  has  been  used  fewer  than  25  times.  Mr.  Thomas 
said  that  Carnivore  had  potentially  broad  capabilities  and  that  he 
understood  the  concerns  of  pri  vacy  groups. 

"It  can  do  a  ton  of  things,"  he  said.  "That's  why  it's  illegal  to  do  so 
without  a  clear  order  from  the  court." 

He  said  that  most  Internet  sendee  providers  had  cooperated  with 
requests  to  use  Carnivore. 

Privacy  groups  and  some  Internet  service  providers  have  been 
deeply  critical  of  the  use  of  Carnivore  because,  once  installed  on  a 
network,  it  permits  the  government  to  take  whatever  information  it 
wants. 

Moreover,  the  government  has  not  said  what  it  does  with  the 
extraneous  material  it  gathers  that  is  not  relevant  to  the  particular 
surveillance. 

The  issue  does  not  often  arise  today  with  the  monitoring  of 
telephone  conversations  because  when  a  law  enforcement  authority 
wants  to  see  a  list  of  telephone  calls  made  by  a  suspect,  the  agent 
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gets  an  order  from  a  magistrate,  presents  the  order  to  a  telephone 
company,  and  the  company  then  turns  over  the  list. 

In  at  least  one  instance,  an  Internet  company  did  not  cooperate  so 
readily  with  the  government.  In  December,  federal  marshals 
approached  the  company  with  a  court  order  permitting  them  to 
deploy  a  device  to  register  time,  date  and  source  information 
involving  e-mail  messages  sent  to  and  from  a  specified  account 


Trying  to  establish 
a  single  standard 
for  different 


Concerned  the  device  would 
record  broader  information,  the 
company  countered  with  a 
compromise:  it  would  provide  the 
government  with  the  requested 


technologies. 


information  about  e-mail  senders 

_  and  recipients,  according  to  Robert 

Com-Revere,  a  lawyer  for  the 
company,  in  recent  Congressional  testimony.  The  company  was 
later  identified  as  EarthUnk,  a  service  provider  with  3.5  million 
subscribers. 


Mr.  Com-Revere  said  the  government  initially  accepted  the 
compromise  but  later  became  dissatisfied  and  wished  to  use  its  own 
device.  EarthLInk  objected  but  was  overruled  by  a  a  federal  court, 
which  ordered  the  device  deployed. 

Other  Internet  companies  have  also  been  critical  of  Carnivore. 

William  L,  Schrader,  chairman  and  chief  executive  of  PSINet,  a 
major  commercial  Internet  service  provider,  said  that  the  system 
gave  the  F.B.L  the  ability  to  monitor  e-mail  messages  of  every 
person  on  a  given  network.  He  said  he  would  refuse  to  permit  the 
government  to  use  the  technology  at  PSINet  unless  agents  could 
prove  that  it  could  only  sift  out  the  traffic  from  a  given  Individual 
that  is  the  target  of  a  court  order. 

"I  object  to  American  citizens  and  any  citizens  of  the  world  always 
being  subject  to  someone  monitoring  their  e-mail,"  said  Mr, 
Schrader,  whose  company  serves  about  100,000  businesses  and 
more  than  10  million  users.  “I  believe  it's  unconstitutional  and  I’ll 
wait  for  the  Supreme  Court  to  force  me  to  do  it." 


Civil  liberties  groups,  meanwhile,  said  that  today's  policy 
announcement  was  an  inadequate  response  to  the  growing 
controversy  over  the  deployment  of  Carnivore. 

"Today's  speech  was  camouflage  to  cover  the  mess  that  is 
Carnivore,"  said  Barry  Steinhardt,  an  associate  director  of  the 
American  Ci  vil  Liberties  Union,  "in  light  of  the  public  and 
Congressional  criticism  of  Carnivore,  we  had  hoped  and  expected 
far  more  from  an  administration  that  likes  to  tout  its  sensitivity  to 
privacy  rights.  Rather  than  glossing  over  Carnivore,  Podesta  should 
have  announced  that  the  administration  was  suspending  its  use." 

_ _ Facing  growing  concerns  about 
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Concern  that  the 
proposals  allow 
federal  agents  too 
much  leeway. 


J 

Facing  growing  concerns  about 
Carnivore,  Attorney  General  Janet 
Reno  said  on  Thursday  that  she 
would  review  whether  the  system 
was  being  used  in  a  manner 
consistent  with  pri  vacy  rights  in 
the  Constitution  and  in  federal 


law,  A  subcommittee  of  the  House 
is  set  to  hold  a  hearing  next  week  on  the  system. 
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While  the  civil  liberties  and  privacy  groups  applauded  giving  judges 
greater  discretion  to  review  certain  kinds  of  requests  tor 
surveillance,  they  were  critical  of  other  aspects  of  the  proposal. 

Marc  Rotenberg,  director  of  the  Electronic  Privacy  Information 
Center,  a  research  organization  that  studies  privacy  issues  and 
technology,  criticized  the  administration  for  lowering  the  standards 
for  surveillance  of  cable  modems  rather  than  raising  the  st  andards 
for  telephone  surveillance. 


"The  Cable  Act  provides  for  one  of  the  best  pri  vacy  protections  in 
the  United  States,"  Mr.  Rotenberg  said.  ’’The  question  is  whether  to 
harmonize  up  or  harmonize  down.  Our  view  is  this  harmonizes 
down." 

Rut  administration  officials  said  tits  Cable  Act  never  contemplated 
that  there  would  be  broad  use  of  cable  modems  for  e-mail  traffic  and 
that  the  standards  used  for  obtaining  warrants  for  telephone 
surveillance  should  also  apply  to  digital  communications  through 
cable  networks. 
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HEADLINE:  The  FBI's  Carnivore:  It  bites  only  under  court  order 
BYLINE:  By  MICHAEL  KIRKLAND 
DATELINE:  WASHINGTON,  July  21 
BODY: 

The  FBI  is  in  a  full-court  press  to  reassure  the  public  about  its  Carnivore  intercept  system,  designed  to 
perform  a  "wire-tapping"  function  on  the  Internet. 

During  a  background  briefing  for  reporters  Friday,  FBI  officials  said  die  system  can  only  be  used  under 
court  order,  and  that  "procedure,  training  and  audits"  of  its  use  will  prevent  technicians  from  attempting 
unauthorized  snooping. 

A  senior  official  added  that  the  bureau  is  looking  for  "a  couple  of  technical  institutions"  outside  the  FBI 
to  independently  "validate  and  evaluate"  the  system's  operation  and  integrity. 

The  system  has  drawn  fire  from  an  unlikely  coalit  ion  of  critics. 

The  American  Civil  Liberties  Union  and  similar  groups  have  attacked  Carnivore  as  new  government 
intrusion  without  proper  safeguards.  The  Republican  leadership  of  Congress  has  also  been  highly  critical, 
and  a  House  Judiciary  subcommittee  has  planned  hearings  Monday  to  explore  what  some  politicians 
believe  is  a  need  for  new  federal  restrictions  on  its  use. 

Meanwhile,  the  average  computer  user  may  feel  that  Big  Brother  is  looking  over  his  or  her  shoulder. 
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Not  so,  says  the  FBI  in  its  most  soothing  official  voice. 


At  Friday’s  briefing  in  a  conference  room  at  bureau  headquarters  in  Washington,  the  senior  FBI  official 
said  the  Carnivore  program  is  three  years  old,  and,  "ft  began  because  we  were  receiving  court  orders  to 
do  intercepts  on  the  Internet." 

Carnivore  software  -  so  named  because  it  looks  for  the  "meat”  in  a  data  stream  -  uses  a  Windows 
platform  and  is  contained  on  a  personal  computer  that  is  plugged  into  an  Internet  service  provider.  The 
access  is  allowed  only  for  the  length  of  time  set  out  in  a  court  order.  "When  the  order  expires,  we  take  our 
equipment  away,"  the  senior  official  said. 

the  ISP  usually  performs  some  "pre-filtering"  of  data  so  that  the  amount  of  information  traveling  through 
the  Carnivore  "filter”  is  not  overwhelming.  The  Carnivore  device  can  perform  a  traditional  "pen 
register”  function  on  the  Internet  -  record  and  store  the  origin  and  destination  of  e-mail  -  or  capture  the 
content  of  an  e-mail  message,  much  like  a  traditional  phone  tap,  only  in  a  much  more  specific  way. 

"That  filter  is  configured  to  fit  the  contour  of  the  court  order  we're  assigned  to  do,”  the  senior  official  said. 
In  other  words,  it  will  only  select  and  copy  specific  information  authorized  fay  a  federal  judge.  Die  system 
targets  e-mail  by  an  "authorization"  code  peculiar  to  an  individual  user,  and  die  FBI  will  not  monitor 
subject  lines  on  e-mail.  , 


The  filtering  process  will  not  slow  down  computer  response  time,  another  FBI  official  familiar  with  the 
technology  said.  "It’s  just  passively  watching  the  bits."  Release  a 
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Hie  approval  process  for  a  Carnivore  intercept  is  also  extremely  rigorous,  an  FBI  official  expert  in  cyber 
legal  issues  said.  Investigators  seeking  a  court  order  to  use  Carnivore  must  go  through  an  internal  FBI 
review  process,  then  the  request  must  be  approved  by  the  attorney  general  or  the  deputy  attorney  general 
before  a  federal  judge  is  approached  for  a  court  order. 

Less  than  a  dozen  such  requests  have  been  made  over  the  last  year  for  criminal  probes  -  as  opposed  to 
national  security  investigations  -  and  no  request  has  been  refused  by  a  judge. 

"These  (intercepts)  are  not  implemented  trivially,"  the  FBI  legal  official  said,  both  because  of  the  expense 
and  the  depth  o  f  review. 

What  about  someone  outside  the  FBI  hacking  into  the  Carnivore  device  and  accessing  an  innocent 
person's  e-mail? 

"The  device  cannot  be  penetrated  from  the  Internet  side,"  the  FBI  technical  official  said,  "Theoretically," 
a  hacker  could  beat  very  high  odds  and  randomly  dial  into  a  separate  monitoring  line,  he  added,  but  even 
that  line  is  protected  by  heavy  security. 

The  senior  official  at  Friday’s  briefmg  conceded  that  the  name  of  the  sy  stem  -  Carnivore  -  has  caused 
some  apprehension.  “Naming  is  always  a  very  sensitive  thing,"  the  official  said,  “This  experience  is 
sobering.”  The  official  said  the  FBI  would  gi  ve  some  thought  in  the  future  to  the  effect  the  name  of  an 
operation  or  procedure  might  have  on  the  public. 

"Sniffer"  might  be  a  fairer  term.  "It’s  a  customized  packet  sniffer,"  the  FBI  technical  official  said. 

”A  very  well-focused  sniffer,"  the  senior  official  added. 
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.  the  Feds  Can  Read  Your  E-M^*  . 


NewsMax.com 


Controversy 

Boortz  on  Boortz 


The  Feds  Can  Read  Your  E-Mail 


NswsMax.com 
Wednesday,  July  12,  2000 

First  it  was  Echelon,  the  global  eavesdropping  system  Uncle  Sam  and  John  Bull 
have  been  using  to  spy  on  satellite-transmitted  phone  calls,  e-mails  and  fax 
messages.  Now  it's  Carnivore,  the  FBI’s  newest  electronic  snooping  device  that 
can  read  your  e-mail  right  off  your  mail  server. 

Capable  of  scanning  millions  of  e-mails  a  second,  Carnivore  can  easily  be  used 
to  monitor  everybody’s  e-mail  messages  and  transactions,  including  banking 
and  Internet  commerce.  If  they  want  to,  the  feds  can  find  out  what  books  you’re 
buying  online,  what  kind  of  banking  transactions  you  conduct  —  in  short, 
everything  you  do  when  you  go  online  and  send  e-mail,  whether  private  or 
commercial 


The  FBI  has  been  quietfy  monitoring  e-mail  for  about  a  year.  Two  weeks  ago 
the  feds  went  public  and  explained  the  high-tech  snooping  operation  to  what  the 
Wall  Street  Journal  called  "a  roomful  of  astonished  industry  specialists." 

According  to  the  bureau,  they've  used  Carnivore  -  so  called  because  it  can 
digest  the  "meat"  of  the  information  they're  looking  for  -  in  less  than  100  cases, 
in  most  cases  to  locate  hackers  but  also  to  track  terrorist  and  narcotics 
activities. 


But  there  is  nothing  to  stop  Carnivore  from  making  a  meal  of  your  e-mail 
messages  and  transactions  if  they  decide  that’s  what  they  want  to  do  and  can 
get  a  judge  to  issue  a  court  order  allowing  them  to  tap  your  e-mail  as  they  would 
your  phones. 


That's  scant  comfort  considering  the  underhanded  means  the  feds  employed  to 
get  court  orders  to  raid  the  Branch  Davidian  compound,  or  to  win  a  judge’s 
permission  to  stage  what  amounted  to  an  illegal  armed  raid  on  Elian  Gonzalez's 
Miami  home. 

Carnivore  is  nothing  but  a  store-bought  personal  computer  with  special  software 
that  the  FBI  Installs  in  the  offices  of  Internet  service  providers  (ISPs). 


The  computer  is  kept  in  a  locked  cage  for  about  a  month  and  a  half.  Every  day 
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an  agent  comes  by  and  retrieves  the  previous  day’s  e-mail  sent  to  or  by 
someone  suspected  of  a  crime. 

But  critics  say  that  Carnivore,  like  some  ravening  beast,  is  simply  too  hungry  to 
be  trusted  -  that  it  gives  the  feds  far  too  much  access  to  too  much  private 
information. 

"This  is  more  of  a  vacuum  cleaner-type  approach  -  it  apparently  rifles  through 
everything,"  David  Sobei,  general  counsel  for  the  Electronic  Privacy  information 
Center,  told  Fox  News. 

“It's  potentially  much  more  invasive  than  telephone  surveillance,” 

Carnivore  could  conceivably  monitor  afi  the  e-mail  that  moves  through  an  ISP  ~ 
not  merely  messages  sent  to  or  from  the  subject  allegedly  being  monitored. 
Critics  compare  it  to  eavesdropping  on  all  the  phones  in  a  neighborhood  simply 
to  zero  in  on  just  one  phone. 

Disturbingly,  the  FBI  has  prevailed  in  challenges  against  forcing  ISPs  to  allow 
Carnivore  to  be  installed  in  their  offices.  According  to  the  Wail  Street  Journal, 
one  unidentified  iSP  put  up  a  legal  fight  against  Carnivore  early  this  year  and 
lost. 

The  FBI  defends  Carnivore,  insisting  it  is  used  selectively  and  monitors  only  the 
e-mail  of  the  subject.  They  say  that  messages  belonging  to  those  not  being 
probed,  even  if  criminal,  would  not  be  admissible  in  court. 

"The  volume  of  e-mail  in  a  location  is  generally  fairly  small  and  being  managed 
by  a  small  number  of  e-mail  servers  on  a  fairly  low-speed  network,"  said  Marcus 
Thomas,  chief  of  the  FBI’s  cyber  technology  section. 

"The  system  is  not  unlike  'sniffers’  used  within  the  networks  every  day.” 

That  fails  to  satisfy  critics  such  as  Sobei.  He  says  Carnivore  is  similar  to 
Russia's  surveillance  system,  called  “SORM,"  which  all  Russian  ISPs  are  forced 
to  install  to  allow  the  government  to  spy  on  whomever  it  chooses. 

It's  also  similar,  he  says,  to  the  notorious  Echelon,  the  National  Security 
Agency's  global  eavesdropping  system,  which  intercepts  telecommunications 
transmissions  from  around  the  world  and  looks  for  keywords  that  could  indicate 
illegal  activity. 

"Carnivore  is  really  the  latest  indication  of  a  very  aggressive  stance  that  the 
bureau  is  taking  in  collecting  as  much  information  as  technically  possible," 

Sobei  said. 


FBI  spokesman  Paul  Bresson  insists  that  law-abiding  citizens  have  nothing  to 
fear  from  Carnivore.  "Anytime  we  develop  a  system,  we’re  basically  balancing 
the  interests  of  national  security  against  that  of  the  privacy  of  the  public,"  he 
said. 


"This  issue’s  always  going  to  come  up.  We're  always  going  to  get  questions  We 
understand  that.” 
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Electronic  Surveillance 


Existing  laws  Permit  Collection 
Of  information  From  E-Mail,  FBI  Bays 

The  Federal  Bureau  of  Investigation  takes  the  posi¬ 
tion  that  current  federal  law  gives  it  the  authority 
to  implement  the  use  of  special  software  and  hard¬ 
ware  called  “Carnivore"  to  collect  information  from  the 
e-mail  messages  traveling  through  an  Internet  service 
provider's  e-mail  server,  according  to  testimony  by  FBI 
and  Justice  Department  officials  July  24  at  a  congres¬ 
sional  hearing.  The  hearing  before  the  House  Judiciary 
Committee's  Subcommittee  on  the  Constitution  was 
convened  in  response  to  an  uproar  triggered  by  a  July 
1 1  article  in  the  Wolf  Street  Journal  disclosing  the  ex¬ 
istence  of  Carnivore, 

According  to  the  officials’  testimony,  if  an  Internet 
service  prorider  is  financially  or  technologically  unable 
or  unwilling  to  provide  information  on  e-mails  pursuant 
to  a  court  order,  the  FBI  will  hook  a  Carnivore  unit  up  \ 
to  the  ISP’s  server.  Carnivore  scans  what  officials  refer 
to  as  "the  smallest  subset"  of  information  from  in  com-  j 
ing  and  outgoing  e-mail  messages.  Carnivore  then  duv  j 
pltcates  the  information  and  lets  the  transmission 
stream  continue  to  flow. 

Carnivore  roads  the  incoming  Information  and  filters 
ii  according  to  protocols  based  on  the  original  court  or¬ 
der.  Usually,  the  order  will  authorize  the  FBI  to  collect 
the  “to”  and  ‘"from"  Information  from  messages  going 
to  and  from  a  particular  e-mail  address.  Only  the  rel¬ 
evant  information  will  be  recorded.  All  extraneous  in- 
formation  will  remain  only  temporarily  in  the  random 
access  memory*  and  will  not  be  fixed  in  a  stable*  re¬ 
corded  format 

The  result,  according  to  the  FBI,  will  be  a  list  of 
e-mail  messages  that  have  been  sent  from  or  received 
by  a  particular  e-mail  address  along  with  the  "to”  and 
"from”  information.  The  FBI  likens  this  to  the  results 
obtained  by  a  combination  of.  telephone  trap-and*  trace 
and  pen  register  devices*  which  produce  a  list  of  tele¬ 
phone  calls  to  and  from  a  particular  number  giving  only 
the  calling  number  or  the  number  called. 

The  FBI  has  implemented  Carnivore  18  times  since 
January  and  about  25  times  overall  since  it  was  put  into 
operation  two  years  ago*  according  to  Donald  M  Kerr, 
assistant  director  of  the  FBI. 

Current  law  Authorizes  Carnivore*  Kerin  V,  di  Gregory, 
deputy  assistant  attorney  general  for  the  criminal  divi¬ 
sion*  testified  that  the  FBI  is  authorized  to  implement 
Carnivore  by  the  current  pen  register  and  trap-and- 
trace  law*  18  USC  3121  etseq.,  and  wiretap  taw*  IB  USC 
2510-22* 

The  pen  register  law  allows  an  FBI  investigator  to  ap¬ 
ply  for  an  ex  parte  order  from  a  court  by  submitting  an 
affidavit  affirming  a  certification  by  the  applicant  that 
’the  information  likely  to  be  obtained  is  relevant  to  an 


ongoing  criminal  investigation/*  The  investigator  need 
not  make  a  showing  of  probable  cause*  and  the  court 
does  not  have  the  discretion  to  refuse  to  Issue  the  order. 
By  following  this  procedure*  the  FBI  may  also  obtain 
from  an  ISP  the  “to"  and  “from"  information  from  in¬ 
coming  and  outgoing  e-mail  messages  for  a  particular 
address. 

Rep.  Jerrold  Nadler  (D-MY.)  expressed  concern  that 
a  subject  of  such  scrutiny  might  never  come  to  know 
that  his  privacy  had  been  invaded  in  such  a  manner*  be¬ 
cause  the  pen  register  Jaw  does  not  require  disclosure  if 
no  charges  are  ever  brought. 

Di  Gregory  disputed  that  any  invasion  of  privacy 
would  have  taken  place  in  such  a  situation.  He  said  that 
US.  Supreme  Court  precedents  establishing  that  a  tele- 
j  phone  user  has  no  legitimate  expectation  of  privacy  in 
the  numbers  he  dials  supports  the  view  that  an  e-mail 
user  has  no  such  expectation  of  privacy  in  the  ad¬ 
dresses  on  incoming  and  outgoing  e-mail  communica¬ 
tions. 

According  to  di  Gregorys  the  FBI  may  gain  access  to 
the  content  of  e-mail  messages  under  the  wiretap  law' 
The  wiretap  lav/  requires  a  high-ranking  officer  of  the 
Justice  Department  to  authorize  an  application  for  a 
court  order.  The  court  may  then  issue  an  order  autho¬ 
rizing  the  government  to  listen  in  on  a  telephone  con¬ 
versation  if  it  finds  that  there  is  probable  cause  to  be¬ 
lieve  that  someone  is  committing,  has  committed,  or  is 
about  to  commit  one  of  the  offenses  listed  in  18  USC 
2516,  that  there  is  probable  cause  to  believe  that  a  wire¬ 
tap  will  intercept  communications  concerning  that  of¬ 
fense*  that  normal  investigative  procedures  have  faded 
or  appear  to  be  unlikely  to  succeed  or  are  too  danger¬ 
ous,  and  that  there  is  probable  cause  to  believe  that  the 
line  to  be  tapped  is  the  line  that  Is  likely  to  be  used  for 
such  a  communications. 

According  to  Kerr  and  di  Oregon'*  implementing 
Carnivore  under  these  statutes  will  result  in  minimized 
and  particularized  information  gathering*  and  does  not 
amount  to  a  search  of  all  incoming  and  outgoing  e-mail 
messages  traveling  through  an  ISP’s  server.  Addition¬ 
ally,  in-house,  technological,  judicial  and  adversarial 
oversight  will  ensure  that  these  methods  are  not 
abused, 

Croups  Dispute  Claim  of  Authority  This  assertion  was 
flatly  contradicted  by  Barry'  Stemhardt  of  the  American 
Civil  liberties  Union,  who  said  that  such  filtering  nec¬ 
essarily  involves  the  inspection  of  every  single  e-mail 
message  traveling  through  a  server.  Such  broad  author¬ 
ity  to  filter  through  private  communications  was  never 
contemplated  by  Congress  when  passing  the  pen  regis¬ 
ter  and  wiretap  laws*  Steinhardt  said.  Furthermore*  he 
said*  no  matter  what  promises  the  administration 
makes  regarding  limiting  its  data  gathering  powers,  re¬ 
cent  history  should  warn  Congress  not  to  believe  those 
promises, 

Steinhardt  offered  as  an  example  the  passage  of  the 
Communications  Assistance  to  Law  Enforcement  Act  of 
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47  SC  1001  et  seq.,  which  resulted  from  a  comprO' 
mlse  with  law  enforcement  agencies  afraid  that  new 
technology  would  hamper  surveillance  of  telephone 
calls.  He  said  that  in  exchange  for  requiring  new  digital 
telephone  networks  to  be  constructed  to  preserve  exist¬ 
ing  surveillance  capabilities,  the  FBI  agreed  not  to  use 
the  statute  to  try  to  require  telephone  service  providers 
to  create  new  surveillance  capabilities.  Nevertheless, 
according  to  Stelnhardfs  testimony,  the  FBI  has  "con¬ 
sistently  sought  greater  capacity  and  new  surveillance 
features  that  did  not  exist  in  1994,  In  some  cases,  they 
have  sought  capabilities  that  they  specifically  promised 
the  Congress  they  would  not  seek*1 

Filtering  out  "to”  and  “from"  information  is  not  as 
easy  as  the  FBI  makes  it  sound,  according  to  Alan  Dav¬ 
idson  of  the  Center  for  Democracy  and  Technology, 
Davidson  presented  the  subcommittee  with  examples  of 
the  type  of  data  packets  that  are  collected  by  Carnivore, 
In  many  cases,  he  said,  the  "to"  and  "from"  informa¬ 
tion  that  the  FBI  Is  seeking  cannot  be  obtained  without 
looking  in  the  body  of  the  message. 

Both  Steinhardt  and  Davidson,  as  well  as  Peter  Wil¬ 
liam  Sachs,  president  of  New  Haven,  Conn.,  ISP 
ICONN  LLC,  testified  that  the  type  of  information  that 
the  FBI  says  it  wants  from  Carnivore  can  be  easily  gath¬ 
ered  by  the  i$Ps  themselves  and  turned  over  to  law  en¬ 
forcement  agencies  who  have  obtained  appropriate 
court  orders. 

Both  Sides  Living  in  the  Past  Both  law  enforcement 
and  civil  liberties  groups  are  still  thinking  m  terms  of 
the  traditional  switched  telephone  network,  according 
to  Stewart  Baker;  a  technology'  expert  with  the  Wash¬ 
ington  Jaw  firm  of  Steptoe  &  Johnson,  and  former  gen¬ 
eral  counsel  to  the  National  Security  Agency. 

Baker  said  that  it  is  unrealistic  to  expect  ISPs,  par¬ 
ticularly  small  ones,  to  be  capable  of  complying  with 
such  an  order  on  its  own.  "The  FBI  has  got  It  right,"  he 
said.  Without  Carnivore  or  some  similar  program,  ISPs 
would  be  faced  with  "an  extensive  unfunded  mandate" 
to  collect  Information  pursuant  to  court  orders. 

On  the  other  hand,  for  the  government  "to  say  you 
don't  have  an  expectation  of  privacy  in  information 
held  by  a  third  party  is  just  crazy,"  Baker  said.  "Our  en¬ 
tire  lives  are  In  the  hands  of  third  parties.” 

Some  kind  of  technological  solution  is  necessary  for 
law  enforcement  to  keep  up  with  techno-savvy  crimb 
nals,  he  said.  At  the  same  time,  innocent  people  must  be 
given  protections.  Whatever  the  Congress  does  decide 
to  do,  it  must  decide  quickly,  Baker  said,  or  legislation 
will  have  been  mooted  by  technological  developments. 

Hew  Legislation  on  Horizon*  The  subcommittee's  hear¬ 
ing  came  a  week  after  a  White  House  official  outlined 
plans  by  the  Clinton  administration  to  introduce  a  bill 
that  would  update  both  privacy  laws  and  provisions  I 
through  which  wiretapping  m  all  its  forms  is  utilized 
The  bilk  which  the  White  House  has  yet  to  send  to  Con¬ 
gress^  would  regulate  under  what  circumstances  law 
enforcement  could  view,  listen  to  and  trace  e-mails,  cel¬ 
lular  phone  calls,  and  transmissions  over  cable  net¬ 
works. 

Speaking  at  the  National  Press  Club  July  18,  White 
House  Chief  of  Staff  John  Fodesta  said  the  bill  "would 
amend  statutes  using  outmoded  language  and  that  are 
hardware-specific  so  that  they  are  technologically  neu¬ 


tral,  In  other  words,  the  legislation  would  apply  equal 
standards  to  both  hardware  and  software  surveillance” 

The  White  House  Is  characterizing  the  proposal  as 
one  that  would  increase  privacy  protections  by  requir¬ 
ing  that  court  orders  authorizing  the  interception  of 
e-mail  be  preapproved  fey  high  level  Justice  Department 
officials.  Additionally,  the  proposal  would  also  make  it 
easier  to  Identify  someone  who  Is  calling  or  using  elec¬ 
tronic  means  to  contact  an  Individual  by  requiring  only 
one  "trap  and  trace”  order  to  trace  a  call  or  Internet 
session  back  to  the  source.  Currently,  law  requires  an 
order  to  be  Issued  for  each  separate  trace  of  an  e-mail, 
which  are  usually  bounced  around  by  a  number  of  dif¬ 
ferent  Internet  services  during  a  transmission,  thus  re¬ 
quiring  multiple  orders  to  trace  a  single  e-mail  Any 
such  orders  must  be  Issued  by  a  judge  after  a  factual 
finding  that  the  standard  for  criminal  activity  was  met. 

The  bill  also  allows  for  tracing  to  fee  conducted  with¬ 
out  prior  court  approval  in  the  case  of  m  "emergency," 
such  as  actions  that  threaten  national  defense,  or  large- 


slon  would  grant  authorities  the  same  access  to  the  In¬ 
ternet  traffic  of  consumers  using  cable  modems  as 
those  who  use  dial-up  modems. 

"With  our  proposal,  we  would  retain  the  underlying 
purpose  of  the  Cable  Act  to  keep  confidential  the  list  of 
shows  that  customer  has  watched/'  Fodesta  said,  "but 
when  cable  systems  are  used  to  access  the  Internet 
through  cable  modems,  we  believe  the  rules  should  be 
the  tough  but  sensible  standards  we  also  support  for 
e-mails  and  telephone  calls." 

Though  the  White  House  has  no  target  dale  for  send¬ 
ing  up  the  legislation,  the  administration  Is  confident 
they  will  be  able  to  work  with  Congress  to  pass  the  leg¬ 
islation,  "We've  been  able  to  strike  the  middle  ground, 
which  will  enable  us  to  get  there  fairly  quickly/'  White 
House  Spokesman  Jake  Siewert  told  BN  A, 

Records 

DOJ  Agrees  to  Release  of  Documents 
Underlying  Report  on  FBI  Crime  laboratory 

Over  53,000  pages  of  background  information  per¬ 
taining  to  the  Justice  Department  inspector  gener¬ 
al's  investigation  of  the  Federal  Bureau  of  Investi¬ 
gation's  crime  laboratory  are  subject  to  disclosure  as  a 
result  of  the  recent  settlement  of  a  Freedom  of  Informa¬ 
tion  Act  suit,  the  National  Association  of  Criminal  De¬ 
fense  Lawyers  announced  July  7.  NACDL  and  its  then- 
press  officer,  Jack  King,  were  the  original  plaintiffs  in 
the  suit  and  were  later  joined  by  Dr.  Frederic  White- 
hurst,  a  former  employee  of  the  lab  whose  allegations 
prompted  the  investigation. 

Besides  allowing  the  plaintiffs  to  disclose  the  docu¬ 
ments,  the  settlement  calls  for  the  Justice  Department 
to  pay  $355,000  in  attorneys  fees  and  to  post  a  pointer 
on  its  website  referring  inquiries  about  the  documents 
to  NACDL’s  and  Whitehurst's  websites, 

NACDL  spokesman  Todd  Wells  said  the  organiza¬ 
tion  would  make  the  materials  available  on  compact 
disc  for  a  cost  of  $40.  Orders  can  be  placed  by  calling 
(202)  872-8600. 
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HEADLINE:  FBI  Defends  * Carnivore'  E-Mail  Wiretap  on  Capitol  Hill 
BYLINE:  Kyra  Phillips,  Pierre  Thomas 

HIGHLIGHT:  FBI  officials  are  on  Capitol  Hill  today  defending  their  new  wiretap 
for  the  information  age.  It's  celled  Carnivore  and  it's  designed  to 
selectively  monitor  computer  e-mail  to  and  from  a  suspect.  If "can  only  be  used 
with  a  court  order.  Still,  critics  are  concerned  about  possible  privacy 
violations , 

BODY: 


THIS  IS  A  RUSH  TRANSCRIPT 


BE  UPDATED. 

KYRA  PHILLIPS,  CNN  ANCKOr 
defending  their  new  wiretap 

It's  called  Carnivore  and  i 
mail  to  and  from  a  suspect, 
critics  are  concerned  about. 


lOPY  MAY  NOT  BE  IN  ITS  FINAL  FORK  AND  MAY 


:  FBI  officials  are  on  Capitol  Hill  today 
for  the  information  age. 

t‘3  designed  to  selectively  monitor  computer  e- 
It  can  only  be  used  with  a  court  order.  Still, 
r:  ob s  i  bi  e  priva cy  vie  1  a  t  i  ons , 


More  now  on  the  controvert'. 


Here's  Justice  correspondent  Pierre  Thomas, 


Hi,  Pierre, 

PIERRE  THOMAS,  CNN  JUSTICE  CORRESPONDENT :  Hi,  Kyra.  As  you  pointed  out, 
the  FBI  says  Carnivore  is  a  new  investigative  tool  which  can  tap  into  the  e~ 
mail  of  a  suspect,  but  only  with  a  court:  order,  But  critics  say  it’s  Big 
Brother  on  the  internet.  And  today,  Congress  wanted  answers. 


(BEGIN  VIDEO  CLIP) 


UNIDENTIFIED  MALE:  Even  a  system  designed  with  the  best,  of  intentions  to 
legally  carry  out  essential  law  enforcement  functions  may  be  a  cause  for 
concern  if  it’s  use  is  not  properly  monitored. 

REP,  JOHN  CONYERS  (D) ,  MICHIGAN:  Constitutional  rights  don't  end  where 
cyberspace  begins . 

(END  VIDEO  CLIP) 

THOMAS:  But  the  FBI  was  quick  to  point  out  the  restrictions  that  govern 
Carnivore.  The  FBI's  top  lab  official  explained  the  safeguards, 

(BEGIN  VIDEO  CLIP) 


UNIDENTIFIED  KALE:  In  every  case  we  require  a  court  order.  That  court 
order  is  specific  to  the  numbers  we  target,  if  you  will,  the  addresses  we  can 
target , 
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{END  VIDEO  CLIP) 


THOMAS :  Today  was  a  fact-finding  hearing  and  there  was  one  point  of  early 
agreement:  Carnivore  may  not  be  the  best  name  for  this  system  —  Kyra, 

PHILLIPS:  All  right,  Pierre  Thomas,  thanks  so  much. 

TO  ORDER  A  VIDEO  OF  THIS  TRANSCRIPT,  PLEASE  CALL  800-CNN-NE&S  OR  USE  OUR 
SECURE  ONLINE  ORDER  FORM  LOCATED  AT  www.fdch.com 
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Who's  Afraid  Of  The  Big,  Bad  Carnivore? 

This  week,  it  finally  happened:  the  government  made  clear  Its  intent  to 
expand  wiretapping  from  switched  voice  traffic  to  Internet  traffic*  The 
implications  for  Xnterriet-service  providers  and  cable  operators  are  enormous  * 

Last  Monday,  White  House  Chief  of  Staff  John  Podesta  proposed  a  bill  to 
{in  my  assessment)  expand  the  voice  wiretapping  allowed  under  the 
Communi ca t ions 

Assistance  for  Lav;  Enforcement  Act  to  e-mail,  Podesta  defended  the  FBI’s 
"Carnivore *  packet-sniffing  software,  which  allows  the  government  to  read  the 
address  information  and  content  of  e-mail. 

My  coverage  of  the  proposal  (C?  7/18)  was  quite  restrained,  as  I  wanted 
to  give  it  fair  scrutiny  before  judging  it, 

I've  given  the  plan  that  scrutiny,  and  1  think  it  Vs  a  had  one.  Here 

are 

two  reasons  why; 

1}  The  administration  avoided  honest  debate  on  the  rationale  for  spying 
on  citizens*  Podesta,  in  particular,  misrepresented  the  uses  of  wiretaps.  He 
also  was  misleading  in  saying  there  had  been  no  improper  voice  wiretaps,  a 
*  fact w  he  used  to  support  IP  wiretapping, 

FBI  and  Justice  Department  officials,  in  testimony  to  Congress, 
inevitably  tout  wiretapping  as  a  solution  to  terrorism  and  child  pornography  - 

political  hot-button  crimes  everyone  opposes*  That  testimony  draws  favorable 
press  coverage  and  congressional  support.  Who  wants  to  be  portrayed  as 
supporting  those  crimes? 

Podesta  hit  the  same  theme  in  describing  Title  III  of  the  1968  Crime 
Control  and  Safe  Streets  Act,  which  set  the  rules  for  voice  wiretapping.  The 
administration  wants  to  apply  Title  III -type  rules  to  Internet  spying, 

"It  only 

allowed  wiretaps  in  the  most  serious  crimes,  such  as  espionage,  treason  and 
crimes  of  violence, "  Podesta  said* 

But  those  are  rarely  the  crimes  against  which  law  enforcement  uses 
wiretaps*  The  1999  wiretapping  report  by  the  Administrative  Office  of  the 
United  States  Courts  (available  on  the  Web  site  of  the  Electronic  Privacy 
Information  Center)  shows  there  were  1,350  Title  III  wiretaps  last  year. 

There 

were  only  174  in  1968* 

The  report  includes  a  breakdown  of  the  crimes  that  were  the  basis  for 
each  wiretap*  A  full  978  of  the  wiretaps  in  1999  were  drug  cases*  Agencies 
rarely  mention  that  fact  when  seek  wiretapping  authority,  because  they  know  it 
weakens  their  argument.  Tap  cur  phones  because  terrorists  might  blow  someone 
up?  Maybe  so.  Tap  them  because  someone,  somewhere,  is  smoking  a  joint?  I 
don ' t  know , 

Drug  cases  were  followed  by  racketeering  (139  cases)  *  Only  when  we 
get  to  homicides /assaults  (62  cases)  do  we  hit  the  *  crimes  of  violence1-  cited 
by  Podesta.  National -security  wiretaps  do  not  even  come  under  Title  III,  but 
the  Foreign  Intelligence  Surveillance  Act.  There  were  886  wiretaps  under  FISA 
in  1999.  No  breakdown  of  those  cases  is  available,  so  we  can f t  tell  if  they 
were  indeed  for  treason  and  espionage.  The  FBI,  of  course,  has  a  history  of 
using  national -security  authority  to  wiretap  such  notorious  menaces  to  the 
common  weal  as  Martin  Luther  King  Jr,*  John  Lennon,  and  any  reporters  who 
happen  to  annoy  Richard  Nixon, 
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Modest a  said  that  all  wiretapping  has  met  Title  III  standards.  *  I  knew 
of  no  case  in  which  a  wiretap  was  thrown  out"  for  violating  those  standards , 
he  said,  Not  yet,  maybe.  But  the  current  Ramparts  police  scandal  in  Los 
Angeles  resulted  in  testimony  about  hundreds,  if  not  thousands,  of  illegal 
wiretaps*  I  asked  Podesta  how  he  could  reconcile  that  fact  with  his 
statement.  Neither  he  nor  his  aides  could.  They  had  no  answer. 


2)  Carnivore  IP  wiretapping  is  fundamentally  different  from  CALEA  voice 
wiretapping.  Taps  on  switched  phone  circuits,  by  their  nature,  record  only 
the  phone  calls  and  tracing  information  of  individual  lines*  Carnivore,  by 
its  nature,  must  intercept  all  traffic  through  an  ISP  to  find  the  suspect 
messages.  We  have  nothing  hut  the  government  *  s  assurances  that  it  will  ignore 
traffic  for  which  it  has  no  warrant. 

Carnivore  also  can  read  content  of  e-mails,  as  well  as  addressing 
information*  Under  Podesta ’ s  proposal,  the  government  standard  for 
intercepting  address  information  would  foe  lower ,  as  it  is  for  pen-register  and 
track- and- trace  information  for  voice  calls.  A  pen-register  intercept, 
however ,  does  not  give  access  to  the  voice  call*  Carnivore  gives  access  to 
the  text  of  e-mails.  Again,  we  have  only  the  government's  assurances  that  it 
will  ignore  the  content* 


Not  all  elements  of  the  Podesta  proposal  are  bad.  He  proposes 
requiring  probable  cause  {the  Title  III  standard)  to  intercept  the  content  of 
e-mail.  And  one  element,  the  removal  of  the  protections  against  cable 
surveillance  in  the  Cable  Act  of:  1993,  is  inevitable,  Whatever  rules  result 
from  this  legislation  should  surely  apply  evenly  to  ISPs  of  ail  technological 
stripes . 

The  depressing  thing  is  how  eagerly  the  phone  industry  now  supports 
CALEA,  The  Telecom  Industry  Association  was  involved  in  developing  the  J-STD- 
025  wiretapping  standard  and  Carnivore,  which  was  unveiled  late  last  month  at 
the  TIA" organ i zed  Joint  Experts  Meeting  in  Washington.  "The  FBI’s  proa ram  is 
extremely  sophisticated, *  TIA  said  Tuesday,  Carnivore  works  with  Microsoft"" 
Outlook,  Lotus  Notes  and  other  e-mail  programs,  the  association  continued. 

Equipment  vendors,  who  originally  balked  at  CALEA ,  now  consider 
wiretapping  a  profit  center,  ADC  l AD CJ  just  rolled  out  its  NewNet  CALEAs erve x 
wiretapping  line,  Mt  receives  the  intercepted  communications  data  from 
various  circuit- switched  network  elements,  processes  it  to  conform  to  the 
requirements  of  J- STD-02 5,  and  then  distributes  it  to  the  appropriate  LEA 
collection  facilities,"  the  company  said  proudly  Thursday, 

Converse  Irifosys  [OKVTJ  also  rolled  out  gear  this  week.  "Converse 
Xnfosys  is  the  industry  leader  in  the  legal  interception  market  worldwide, * 
President  Dan  Bodner  bragged. 

Current  rumblings  suggest  ISPs  are  less  happy  about  spying  on  their 
customers.  Don’t  be  fooled,  though  —  they’ll  do  it.  The  Podesta  proposal 
and  CALEA  should  be  stopped  before  spy  equipment  becomes  an  inextricable  Dart 
of  our  basic  communications  network. 

Paul  Coe  Clark  III  is  the  editor  of  Communi cations  Today .  He  can  foe 
reached  at  (301)  34Q-77SB,  ext.  2037,  or  at  pclarkEphiXIips *com. 

LANGUAGE:  ENGLISH 


LOAD-DATE;  July  24,  2000 


5/24/02  Rdease  *  Page 


*  •  ' 


Copyright  2000  CNBC,  Xnc. 
CNBC  Hews  Transcripts 


i 


SHOW;  RIVERA  LIVE  *9:00  PM  ET} 


July  24,  2000,  Monday 


LENGTH :  1375  words 

HEADLINE?  WHETHER  THE  GOVERNMENT  SHOULD  BE  ALLOWED  TO  INTERCEPT  INTERNET  E- 
HAILS 

ANCHORS  ?  DAN  ABRAMS 
REPORTERS?  JOE  JOHNS 
BODY; 

Mr.  DONALD  KERR  (Director,  Lab  Division,  FBI}:  Hackers  break  into  financial 
service  company  systems  and  steal  customers'  home  addresses  and  credit  card 
numbers.  Criminals  use  the  Internet's  inexpensive  and  easy  communications  to 
commit  large-scale  fraud  on  victims  all  over  the  world,  and  terrorist  bombers 
plan  their  strikes  using  the  Internet,  Investigating  and  deterring  such 
wrongdoing  requires  tools  and  techniques  to— designed  to  work  with  new  and 
evolving  computer  and  network  technologies . 

DAN  ABRAMS,  host: 

But  now  far  should  law  enforcement  be  permitted  to  go  to  combat  criminals? 
Should  they  be  able  to  cap  into  someone's  e-mail  to  see  what  is  sent  out  and 
received?  The  FBI  says  yes,  and  they  say  they  now  have  a  new  surveillance 
system  that  can  isolate  a  suspect's  messages  without  invading  the  privacy  of 
others,  an  electronic  strainer  of  sorts.  They  say  it  has  the  same  effect  as  a 
phone  ’wiretap,  a  rarely  used  technique  to  monitor  a  specific  suspect  with 
permission  from  a  judge.  But  others  say  the  FBI's  new  Carnivore  system,  as  it 
is  known f  is  an  invasion  of  privacy,  that  itTs  nearly  impossible  to  isolate 
only  the  relevant  e-mails  and  that  the  FBI  would  have  access  to  far  too  much 
1 n f  o rma t i on «  To da y  t  h e  debs t e  1 a need  on  Capitol  Hill*  NBC  * s  Jo e  J ohns 
reports* 

JOE  JOHNS  reporting: 

Fears  that  e-mail  from  lav;- a bidding  users  of  the  internet  could  be  swept  up 
in  a  new  FBI  computer  system  designed  to  catch  terrorists,  con  artists  and 
hackers  led  Congress  to  schedule  today's  hearing.  But  some  on  Capitol  Hill 
say  drastic  action  may  be  needed  to  put  the  brakes  on  the  FBI  e-mail,  wiretap 
system  known  as  Carnivore v 

Representative  RICHARD  ARMEY  (Republican,  Majority  Leader} *  Well,  1  would 
shut  down  Carnivore  now  if  I  were  at  the  agency, 

JOHNS :  Carnivore  is  a  computer  application  installed  on  a  PC  that  agents 
connect  to  the  hardware  of  an  Internet  service  provider  to  search  for  specific 
senders  and  receivers  of  messages.  The  FBI  needs  a  court  order  to  use  it  and 
says  only  targeted  information  is  retrieved,  that  no  Indiscriminate  snooping 
is  allowed. 

Mr,  KERR:  We '  re  not  in  the,  you  know,  broad  surveillance  business  in  any 
way*  We're  a  law  enforcement  agency  limited  in  what  we  do  by  what  the  courts 
order  us  to  carry  out. 

JOHNS;  But  many  Internet  service  providers  don't  like  it. 

Mr*  CHARLES  ARDAI  (Juno  Online  Services):  I  think  our  customers  would  not 
take  kindly  to  the  idea  that  their  private  information  could  be  available  to  a 
government  agency. 

JOHNS:  Still  one  scholar  who  specialises  in  privacy  issues  says  it's  a  tool 
law  enforcement  needs. 
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Mr.  AMI  TAX  ET2XGMI  (George  Washington  University)  :  Now  more  and  Tore 
communications  advance  through  the  internet  Ard  withmst* 

FBI  cannot  do  its  job,  Wltn°ut  intercepts,  we —the 

Union  ha«  filS  *  »r.22LStii%f2  challenge.  The  American  Civil  Liberties 
code-  thatfthpd«ii^  d  f  f  lRfocmatlon  xemest  demanding  Carnivore  compute- 
Capitol  government  wants  to  keep  secret.  Joe  Johns,  NBC  News,  the 

nw  f5°®  Kington  is  Ari  Schwarts  from  the  Center  for 

Sf,‘S  SchKfSSK;  -K  the  “*«■>«•  »■»£ 

cybersnooping  by  titled? .  S  to  dlscuss  Carnivore  and 

Mr.  Schwarts,  let-let  me  start  with  vou 
effect,  than  a  wiretap? 


Why  is  this  any  different,  in 


Af: r . SCHWARTZ  (Analyst,  Center  for  Democracy  and  Technology}  •  if 

dif rerent  in  a  few  ways.  The-the  biggest  difference  riaht  now  isV^r',;^ 

4S«dr  SLfT°  “V“?y*3.,;*  r™  «•.  **•  ■»«. »« 

«  «-vC  ,  Ovx  s  on  to  tna  internet:  s^rvi  c&  Drovid^^ 

Even  tno  internet  service  ~  v  ,  *,  p*g\ igs^  , 

different  than  the  wa^^a-o^e  S-V  A*nOW*how  ^  works*  ^at*s  much 

.*1  v.»a„  P*-o**e-  U«ui-Ujan  phone  wiretapping  happens  now. 

»*■  i  ,  5*At'+‘  QO+hOUv> t ITS t lOnS  to  VAriOU1?  npnnl  p 

to  say,  'Look,  oor  .«  •ra^w  _  people 


’  s 


lot  ho  d  i 


to  <1  effBrr'  ^  place,  i*«rve  got  a  system  which  is  c 

^  a. phone  tap.  w«  can  isolate  exactly  which' 
*  *  b  ~  v,e  v‘ant  tw  ‘-«P  into.  '  Ana  with,  you  know,  all  of  the 


We've  got  a  system  which  is  going 


cyberterrorism,  in  addition  to 


nor 


*.u„  T  : .  '  '  2“ZT*r  %xw  oerter which  is  occurring 

truuugn  v,he  iHcti wCt ,  i.  tnmfc  a  xot  of  paoDie  aiT  <?»vv«rt  <  r  -  -icy 

comfortable  ^  x  «-v*^  V p  x  a  teex  a  lot  isor* 

“n°v’  w>,«A  -y  rBI  can  be  snooping  on  possible  terrorists.- 


>*U- 


Hr ,  SCHWARTZ r  Wei 1 ,  the- 
balance,  and  that's  really  i 
between  privacy  and --and  th 
The  problem  that  we've  seen 
what  - -what  gets  pulled  out  : 
knowing  what's  kept  in  the  : 
different.  As  I  .said,  tu 
can  *  t  we  just  see  the  code  : 


-there's  n— there's  nothing  at— we- -what  we  need  -:. 
«i#t  we’re  getting  at  here,  is  we  need  a  balance 
s— tne  kind  of  searches  that  you're  talking  about 
rs  that— the  difference  of  showing  a  demo 'about 
.s  or  t  rerent  than  s— than  knowing  the  technology, 
;ogs,  wnat  can  be  retrieved  later  on.  That's  much 
,ve  „x,e  coue  , or- -tor  tne  phone  tapping  system.  vJhs 
m  this  case?  “  ^ 


tha^^J0«entaSoreridh*trti*Ht!?®-arfifU'rah8  *rSUE!ent  on  the  other  side  is 
right?  protectee  and  that  it  would  allow  hackers  to  break  into  it, 

Hir  A  SvHWAET2  W  Wfill  f  th”  “thst  f  £  tvtV'pi  +■  f-’kpi  y  t'V.jaa  (  «  I  ..  S  + 

But,  of  course,  again,  as  I  said,  we  have  th7same-we  h-ve^h^  -®nC*eS*  are* 
network  thft  di?* t8lvpho£*  network.  We've  had  hackers  in“ the-iithe  Sore  S6t 
co£  S  hJvrit*opSU  '  ^  Can>t  We““We  ShDUld  -iusc  ^  to  see  "this 

your  — tf — i fKd"  and  S°  Uiat  S  your"that's  >'our  Primary  grip,  i  mean,  is 

Mr ,  SCHWARTZ :  Well,  that- -that- ~ rhst* * «:  f-ho  . 

_ -  s  L.ne  mam  concern  with  ramixmrsi 

ff  tL^estSn  of  tLT-ern  ^ivore  raises  and  shows  for  the  future 

stion  of  the  decay  of  the  Fourth  Amendment .  Vfe're  having  a  lot  more 

ever  have  inntheSnast  °whe°Tf  ^  Wtems  and  on  third-party  systLs  tha/we 
^  u^ve  m  tno  past.*  V?herj  the  of  the  -5  ihut-  %  s  , 

Amendment,  which  is  protections  from  unreasonable  Marches  and  sJizSe/bv^ 
government,  people  had  the  files  in  the^  r  r  T  !  St“,  5  ^Uf8S  by  the 
and  Wk  on  their  door.  That's  no?  th^LS  ^oday  gwerrjnent  had  to 
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Abrams :  Nancy  Grace,  Fourth  Amendment  problem? 

Ms*  NANCY  GRACE  ( Anchor ,  Court  TV):  Well,  you  know,  of  course  that’s  not 
what  ^ramars  to  mine  when  they  wrote  the  Constitution*  But,  Dan,  the 
Fourth  Amendment  has  been  applied  for  everything  from  abortion  rights  to  what 
you  carry  in  your  car  trunk,  it  can  certainly  be  applied  to  computer  access  * 
My  only  concern  is*  you  know,  years  and  years  and  years  of  Fourth  Amendment 
law  regarding  wiretap  has  developed  over  the  past  decades,  and  that  same  law 
needs  to  be  applied  now  to  intercepting  Internet  communications*  It  cannot  be 
a  fishing  spree  on  the  part  of  the  government.  On  the  other  hand,  a  warrant 
allows  you  to  open  doors,  open  boxes,  open  mail  and  open  the  Internet. 

ABRAMS:  Got  to  take  a  break*  Our  topic  this  part  is  Big  Brother -s 
Watching*  When  we  come  back,  we’re  going  to  talk  about  a  sheriff  who  is 
putting  Web  cams  xn  his  prison.  We *11  be  back  in  a  minute. 

{ Anno  unc  emen  t  s ) 


ABRAMS:  Before  we  get  to  the  sheriff  who  has  installed  Web  cams  in  his 
prison,  I  want  to  talk  to  Michael  Nasatir  about  this  issue  of  this  FBI  procram 
tnat  you  can  attach  to  Internet  service  providers  to  basical Iv  look  at  what 
people  are  e-mailing*  What  do  you  think? 


Hr.*  MICHAEL  NASATIR  t'Crimi 
gentleman  from  Washington  is 
libertarians  have  a  crack  end 
be  a  secret.  The  technology 
t  o  kn ow  wha  t  we  ’  r  e  ob j  e  c  t  i ng 
do  agree  with  Nancy  Grace* 
specific  and  have  the  F— Four 


nal  Defense  Attorney):  You  know,  I  think  whet  the 
say i ng  is,  *  Look ,  1 et,s--let,s  let  the  civi  1 


se®  what:  they’re  really  going  to  do*  It  cannot 
nas  got  to  be --we’ve  got  to  be  able  to  study  it 
to  or  not  objecting  to.  And  at  the  very  least  I 
at  them  get  a  court  order  for- -and  keep  it 
th  Amendment  apply  for  sure. 


ABRAMS ;  Well  — and  I  think 
have  to  make  an  application 
I  want  to  thank  Ari  Schwartz 


cnere's  no  question  that  there  would  be- -they'd 
lor  a  warrant  the  same  way  they  do  with  a  wiretap, 
tor  joining  us  and  talking  about  this  topic* 
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SHOW;  WORLD  NEWS  THIS  MORNING  < 6  r  0 0  AN  ET) 

July  24,  2000 i  Nonday 

TYPE:  Newscast 
LENGTH :  324  words 

HEADLINE:  FBI  E-MAIL  SURVEILLANCE  PROGRAM*  COMES  UNDER  FIR™ 

ANCHORS;  ANDERSON  COOPER 
REPORTERS  :  ANDREA  NcCARREN 
BODY; 

ANDERSON  COOPER,  anchor: 

.  Fe3eral  agents  say  they’ve  coma  up  with  a  high-tech  way  to  find  criminal 

PaC®  t0  ?lan  *<*8,  bat  critics  contend  the  system 

S°eS  tD°  far‘  That  ls  the  focus  of  a  hearing  on 
CapitOj.  tocsy .  Here  now  is  ABC's  Andrea  McCarren. 

ANDREA  KcCARREN  reporting: 

(VO)  The  FBI  says  Carnivore  is  an  essential  law  enforcement  too1  -o  ice 
in  tne  rapidly  growing  world  of  cyber  space.  .  P—tce 

Kr.  DONALD  KEER  {Assistant  Director,  FBI) ;  The  range  of  crimes  that  are 

tat ea  oy  computers  didn't  exist  before,  so  we  now  have  Internet  fraud 
rather  than  iraua  on  paper, 

KcCARREN:  (VO)  The  technology  allows  the  FBI,  with  a  court  order,  fco  .<* 

r!2?L?f  private  s«X^ting  out  those  to  and  from  a 

p*ruC^&i  ^rihdta;  suspect,  rut  privacy  advocates  say  the  system  is 
because  it  sorts  through  the  private  e-mail  of  innocent  people,  too' 

iV*CL S?ec^Hsc} ;  *c‘s  *  iittle  bit  like  looking  at  all 
u'~  c  ?  °T  a  bigh^uy  just  to  tina  the  blue  Honda  vou  want,  end  it  *  i<-  ■  » 

extremely  intrusive.  *  '  *> 

iV0!  ?h«  Clinton  administration  proposed  that  the  strict  o-ivacy 
communications  *PPiy  t0  cel*phone  service  be  extended  to  electronic 

‘-■C-ih  P0;jc,oTA  {white  Bouse  Chief  or  Staff):  What  we're  interested  in  is 
co«u,.g  up  with  a  balance  that  accounts  for  the  needs  of  law  enforcement  to 
pursue  pursue  organized  crime  and  narcotics  traffickers  but  also  protects  -he 
privacy  of  individual  Americans.  l  '-*nri 

f.rH^"'?SEK:  {10)  ?Y*r  the  l«st  i'aar-  the  FBI  has  used  Carnivore  in  about  2*> 
crimmax  investigations,  ~ 

r^ulr-T^k  Tit  35OWinH  prv5cy  concerns,  the  agency  plans  to  submit 
Carnivore  to  a  third  party  for  an  independent  assessment.  The  FBI  wants  to 

publifthat  Seifonlin?privLyDSSD-o!:;ctedth\nre  reassure  the 

,  7  privacy  is  pro  tec  tea,  Anarea  McCarren ,  ABC  New*? 

Washington*  4 
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ABC  NEWS 

SHOW:  WORLD  NEWS  TONIGHT  (€:30  PM  ST) 

July  24,  2000,  Monday 

TYPE:  Newscast 
LENGTH:  442  words 

PRESIDENT  CLINTON  RETURN'S  TO  CAMP  DAVID  TO  ASSIST  IN  PEACE  TALKS;  BX 
DEFENDS  E-KAIL  MONITORING  SYSTEM 
ANCHORS;  PETER  JENNINGS  . 

REPORTERS;  JOHN  COCHRAN 
BODY: 


PETER  JENNINGS,  anchor: 

At  Camp  David  in  Maryland,  day  14.  The  Israeli  and  Palestinian  leaders 
have  holed  up  for  two  weeks  now  with  hardly  a  leak  to  the  news  media, 

which  in  itself  is  quite  remarkable.  President  Clinton,  just  back  from  Japan, 
spent  much  of  xast  night  and  most  of  today  in  the  talks,  desperately,  we  are 
toj.d,  trying  to  coax  the  parties  into  some  kind  of  a  deal,  ABC’s  John 
is  covering  Camp  David  for  us* 


shn,  looking  at  your  notes  to da 


a  am  nis  t  r  a  t  ion  o  f 
look  good  at  all? 


y,  'Not  looking  good,  senior 
txciaiB  will  take  a  miracle,  f  say  the  Palestinians,  do esn‘t 


JOHN  COCHRAN  reporting: 

That  *  $  right,  Peter.  A  senior  administration  official  told  me,  just  a 
short  time  ago  he  believes  the  talks  will  end  one  way  or  the  other  this  week 

not  optimistic.  On  top  of  that,  Palestinian  officials 

^Ola  Abw  new s,  tney  «eneve  it  will  take  a  miracle  to  achieve  a  breakthrough, 
Tne  key  s tumb ling  block,  not  the  only  stumbling  block,  but  the  key  one, 
continuing  to  be  Jerusalem,  So  much  so,  that  today,  the  negotiators  s imply 
took  that  subject  off  the  table  and  concentrated  on  other  issues* 


JENNINGS :  So  why  did  they  take --John,  John,  why  do  they  take  Jerusalem  off 
the  cable  and  expect  they  can  get  anywhere  like  a  deal? 

COCHRAN;  Well,  what  they  would  like  to  do  is  to  try  to  get  an  agreement  on 
land  and  security  and  they  are  getting  the  director  of  the  CIA,  George  Tenet, 
to  help  them  on  this  security  issue.  If  they  can  resolve  those  issues,  maybe 
they  can  go  back  to- -to  the  issue  of  Jerusalem.  What  they  would  like,  Peter, 
is  to  get  at  least  a  partial  agreement  this  week,  something  that  will  enable 
both  sides  to  come  back  at  least  in  August  and  keep  banging  away. 

JENNINGS;  OK,  John  Cochran  covering  Camp  Maryland  for  us.  There “s  the  kev 
phrase,  partial  deal,  Jerusalem  has  always,  always  been  the  final  issue. 

The  FBr  was  on  Capitol  Hill  today  defending  its  e-mail  monitoriiig  system 
the  ominous -sounding  Carnivore,  against  concerns  that  it  casts  too  wide"  a  net* 
The  agency  told  Congress  today  it  only  uses  the  system  to  eavesdrop  on 
suspected  terrorists,  computer  hackers  and  other  criminals,  not  on  law-ahidino 
citizens.  Some  people  will  not  be  convinced. 


When  we  come  back,  a  plague  of  grasshoppers  in  Texas, 

Mr.  JAMES  ROBINSON  (Entomologist)  :  These  are  some  of  the  worst  outbreaks  of 
insects  for  our  cattlemen  in  the  state  that  I’ve  witnessed.  ' 

JENNINGS;  And  surviving  a  storm  off  the  Louisiana  coast.  Was  it  murder  or 
self-preservation? 
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July  24,  2000/  Monday 

TYPE :  News cast 
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HEADLINE:  NEW  SURVEILLANCE  SOFTWARE  ALLOWS  sm?  wa 

USERS*  E-MAILS  A^LIMS  a  HE  FBI  TO  SNOOP  THROUGH  COMPUTER 

ANCHORS  :  JOHN  ROBERTS 
REPORTERS:  JIM  STEWART 
BODY ; 

JOHN  ROBERTS ?  anchor: 

lawSLrl^conJerns  ™L^.Capi*oi  MiU  today  to  respond  to 

potential  for  abuse.'  Cri tics  fear  thi^ew”so£t surveillance  program  and  its 
so  easy,  it  leaves  ordinarv'LericaS  Cnl^rahfe^  <IR®  f  government  snooping 
Jim  Stewart  has  more.  nS  Wlnerable  to  invasion  of  privacy.  CBS* 

J I K  STEWA  RT  1*  ep  o  r  t  i-nq ; 

Every  day,  more  than  a  billion  e-maile;  «,•,*  .. .  • 

users ,  and  the  FBI  tMnV«*  "  ls  ®  sent  and  received  by  computer 

oay.  But  the  problenTfor  ?U8t  a®  fond  of  fckem  a®  the  next 

all  the  gibberish  to  find  aSy  meanin  glulevi  Se'>  K.ivW  c 

SSS,:C  tfclnte  “•* *—  «*  -»■*'-  in  ;“«tra^siS  S3S  “M 

Mr.  LARRY  PARKINSON  (General  Counsel,  FBI!;  This  •*  s-deso-' <-e  ,>n 
unfortunate  name,  this  is  a  tool  that  is  very  surgical"  P 

ifs'nothing^f'thin^  Sl^o^putefthe^B^ca^l0”  ^  ^*ically, 
*“»  <*•»  «*w«  ..me.'  SL  IToSi:?  “n.™i«l>in3 

of  reaomg  every  AOL  customer's  e-mail  it**-  LS  .  m:  dJt  msteao 
lust  the  __  _>  r  *  ^  V  -‘^s^ntpa  to  *ero  in  and  record 

J  a.wsages  sent  to  ana  from  one  particular  e-mail  address, 

M*. .  KERR  (Director,  Lab  Division,  FBI!  *  We  don*  t-  ..  u— 

in  my  view  could  not  be  '  ihat  8  not  ^horized  by  a  court  order  end, 

STEWART:  Critics,  however,  immediately  asked:  Who's  watching  the  watchers? 

to  2*  ^sss^ss^n  fn^gy^sM^-r  hr  — 

STEWART:  The  reason  for  the  skepticism  is  t-hrtra* »  u ^ 

between  wiretapping  the  Internet  and  wiretapping  a  telephone 

to  hug  your  telephone,  they  get  a  court  nrd*bi-  V  '  \  ^  th&  FBI  wants 

the  phone  company  makes  the  connection  for  f L  w£  to  H-e  £hone  company ,  and 

wiretap  your  Internet  address?^  get  a  coSlt  order WantS  to 
the  connection  themselves,  Y  g  urt  or^er  and  then  they  can  make 

They  ve  done  it  16  times  this  year  already  «*«+.  T 

hackers,  and  the  potential  list  of  quemoh  a^?inst  Internet 

aaentc  x  i asl  or  suspects  and  their  crimes  is  arowina 

agents  warned.  Four  years  from  now,  the  number  of  c»err^ i  ^ '  ?7?mngi> 
alone  is  expected  to  top  200  billion  *  WAr.  con®te~.cial  «-**»!  1  messages 

Washington,  millon  a  yeax  ‘  Stewart,  CBS  News, 

ROBERTS:  And  next  up  on  the  CBQ  iiycrao  , 

V  Wii  ioe  evening  NEWS,  a  new  scheme  to  bilk  the  old 


S/24/02  Release  -  Page  775 

~£>cC^3C 


and  steal  their  trust. 
{Graphic  on  screen) 

CBS  Market Watch 
DOW  JONES  INDUSTRIALS 
CLOSE  down  48.44  10,685.12 
NASDAQ 

CLOSE  down  112.88  3,981.57 
CBS . KARKETWATCH . COM 
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MAILS '  FBI  FIRE  FOR  USING  INTERNET  SOFTWARE  TO  WATCH  SUSPECTS'  E~ 

REPORTERS:  CHARLES  OSGOOD 
BODY: 

CHARLES  OSGOOD  reporting: 

THE  OSGOOD  FILE.  Charles  Osgood  on  the  CBS  Radio  Network. 

The  FBI  is  able  to  read  supposedly  private  e-mail  and  oth*r  intern#* 
tratfic  using  a  svstem  called  r^rr^wnr*  Q";  internet 

dictionary  L  ^  fiLw  77?'  Uar**voie,  Carnivore,  according  to  the 
is  any  ilesn-eetino  animal  vyr  ^  „ 

u»  OI  plant.  Not  to  worry#  says  the  FBI, 

Mr.  LARKY  PARKINSON  (General  ro^wl  rw*. 

this  is  a  tool  that  is  very  — J  DeBpite  xts  ^tortunate  name 


ry  surgical 


OSGOOD:  Where  have  we  heard  that  before?  Stand  bv, 
(Announcements } 


OSGOOD:  The  American  Civil  Liberties  Union  is  conce-n^d  to  -w 
about  the  FBI’s  Carnivore  system  for  snooping  on  £e Internet  V  "  S!" 

Unidentified  Kan  Si;  This  is  the  equivalent  of  coinc  to  the  no*-*-  n*fir->  •»•** 
stationing  an  FBI  agent  there  Iook<ncr  at  t»~e  /  s  pc"  and 

letter  that  goes  through.  '  ~  C  accessing  intorsnation  of  every 

Dona?d°KerrK°'  Xt’®  nothing  like  that  at  says  the  FBI  Lab  Division's 

-irvei>?^D.  KffRtiFBI  h&h  Divisior') :  »«  don’t  do  broad  searches  or 
surveillance  with  this  system,  v~ 

OSGOOD :  The  bureau  is  bcino  v©rv  ako  auAn+l  .  -  , 

civil  rights  with  Carnivore  P  ^°w  violating  anybody’s 

^naore,  say^  tne  rt>2  general  counsel  Larry  Parkinson. 

-Vi''  ^-^hlNSON:  Tnis  is  a  tool  that  is  deployed  rarely  and  it  I*?  never 
deployed  without  s  court  order.  *  a  ‘  iS  t*e/er 

nP  ?!f°2D:/n  ?ther  words'  ’Trust  us.*  'Not  good  enough,'  savs  Alan  Davids™ 
the  Center  for  Democracy  and  Technology .  n  Davidson 

access  r^,i^VIDS°N  (^nter.for  Democracy  and  Technology).-  Carnivore  has 
^  k  L  ?w  l  information  than  it  is  legally  entitled  to  collect  How  do 
Si»'a,<£S15“  C,,rr-1TOI'?  “»  *>  “•  *■»*  «h«  kind  of  iSi  h« 

£o 

Mr.  KEVIN  DxGRRGORY  (Deputy  Attorney  General)  *  m*«v  -  - 

confront  even'  day  in  the  nhvsical  worL  Sll-  ay  ?f  the  crimes  that  we 
world.  Physical  world  are  beginning  to  appear  in  the  online 

the°online  world^too*  t*h»S[*e£  t^at  occur  the  physical  world  occur  in 
onixne  world,  too.  That’s  why  Congress  is  now  taking  an  interest  in 
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Carnivore.  John  Conyers,  Democrat  of  Michigan, 

^tPl^TntatiVe  Z°m  C0HYERS  (Democrat,  Michigan) :  Constitutional  richts 
don  t  end  where  cyberspace  begins.  *  rente  s 

is  °th»rp*«Aia?  1 ''  t|!e  ?fX  ls  as  scrupulous  shout  using  Carnivore  as  it  savs  <t 
*  •  »  always  Murphy’s  Law  to  consider.  That's  the  one  that  savs  'if  " 

Alabama?  °*  Can  happen'  1C  win-’  Republican  Congressman  Spencer  Bachus  of 

abJSfaS? “CB°S  (RepufaUcan'  Alabama),  The  potential  for 

OSCOODi  THE  OSGOOD  FILE.  Charles  Osgood  on  the  CBS  Radio  Network. 
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Justice  Department  officials  defended  its  “Carnivore*  e-mail  scanning 
program  on  Monday  in  front  of  a  House  panel,  saying  it  is  "narrowly  focused" 
and  they  have  used  it  3ust  25  times  in  two  years,  including  16  times  so  far 
this  j'ear.  Discriminating  between  users'  messages  on  the  Internet  . ..  is 
exactly  what  Carnivore  does, *  said  Donald  Kerr,  assistant  director  at  the  FBI. 

it  does  not  searcn  through  the  contents  of  even''  message  and  collect  those 
£LT^“rtain  hey  words  like  -bomb'  or  ’drugs.’  It  selects  messages 

on  criteria  expressly  set  out  in  the  court  order,  for  example,  messages 
lXT*a  partl^u^r  account  or  to  or  from  a  particular  user.’’ 

.  *■*  ^he  house  Judiciary  Subcommittee  on  the  Constitution  that  a'U  but 

hut  f  >°frfv-  *$**  ye2r  have  been  £or  "nationai  security  reasons,’’ 

orde-L^^irrt^L^^  ab?ut  **•  cases.  Attorney  General  Janet  Reno  has 

inaepen^e-.t  review  or  the  system  to  determine  whether  it  infringes 
on  p*!!. acy  rights.  T.*e  American  Civil  Liberties  Union  has  filed  a  Freedom  of 
Information  «ct  request  with  the  department  for  all  documents  related  to 
Carnivore*  0-  w 

.  AP°riier  Inxernet  file-trading  service  is  facing  a  lawsuit  by  HoUvwood 
neavy  hitters.  Scour .com,  a  site  that  searches  the  Internet  for  music  and 
Vj.aeo  files  ana  allows  users  to  exchange  them,  is  the  target  of  a  coDvrieb*- 

hUX^  ^ledt,£n  New  York  by  the  Recording  Industry  Association  of 
America  and  the  Motion  Picture  Association  of  America.  Scour.com,  which  is 
backed  in  part  oy  former  Disney  head  Michael  Ovitz,  said  it  was  "very 
surprised’’  by  the  lawsuit,  because  the  company  had  been  in  recent  talks  with 

•hipster  ShPSies.“U0-  &*  S°ny*  Chairman  Jack  Valenti  called  the  site 

The  ^recording  industry’s  case  against  Napster,  meanwhile,  goes  to  trial  on 
heunesoay  in  San  Francisco.  Lawyers  for  the  major  record  labels  are  expected 

andacLy-igh?eiSriS™rtcr  b?fause  ic  a^edly  promotes  music  piracy 

na  copy-  J-ffh-  intii.igement,  Napster  allows  users  to  share  MP3  digital 

f ° i » -  tbaY  ar®  compact-disc  quality  and  can  be  downloaded  in  a 
ra't  that  Napster  has  given  millions  and  millions  of 
Kaos  ter  CEO  °  bearmuBic ,  they  haven't  heard  before,"  said 

exl^c-  it  ?o  S  Sfoklv  tNhe'  rk  Vimes'  Expsrc«  washing  the  case  don’t 

waJSS  ?ulcfvir  issues  are  complicated,  and  Napster  has  amassed  a 
Dattled-haidened  legal  team  on  its  side*  0* 


K,  i  f  f  S  recently  arawn  a  lofc  ot  the  media’s  attention,  but  the 

s  oiggest  case  is  still  simmering  in  the  background.  A  federal 
ludge  found  m  June  that  Microsoft  had  used  illegal  and  unfair  tactics  to  oush 

SuDremedCour tPep'« t 1 ??  SyStem,-a?d  ,the  company  has  one  appeal  left  -  to  the 
Supreme  Court.  But  the  case  might  have  one  last  detour.  Microsoft  wants  to 

court  ?nfhf^a^antlferu?te-aw  enacte(i  in  the  «70s  that  would  allow  a  lesser 
court  to  hear  the  appeal  first.  According  to  the  Washington  Post  the 

company’s  lawyers  believe  the  Supreme  Court  would  benefit  from  another  review 
df£5??Ual  and  pIOC®<Su.ral  isfa{2s  1R  hhe  case.  The  government  and  the  company 
more  papetwork  on  the  issue  m  August,  and  the  Supreme  Court  could 
make  a  decision  by  vhe  fall  on  whether  it  will  hear  the  appeal,  0- 

forSaePbvokK^g4,St«fa^«  ff£ered  bis  new  serial  novel  “The  Plant*  on  the  Web 
"Se  a  because  he  wanted  to  test  how  people  would  respond. 

We  have  a  generation  of  computer  jockeys  that  we’ve  raised  on  Naoster  and  MP3 
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ifcho  have  gotten  .»  *  *  the  raistakon  id^a  thaf  &xr&Trvt-hi'ns-t  v-u 

And  l*d  like  to  see  if  we  h  ?  x?  th?  store  is  free. 

fruit*?  of  ^  ^  reeducete  these  people  to  the  idee  that-  t'ha 

.,u  ,  s  or  talent  cost  you  money,*  the  author  m hn^/  ,««,  «~!  n  * 

Morning  American  Headers  can  download  th2  d  y-?n  ABC  s  Good 

Without  paying  the  $1,  but  accSS  J®!  ktW„p?rClori8  cf  the  book 

the  story  folds. »  ^  i£g  ?5°5?SSt  “.“S?  S^,*“  S“l 

order  to  keep  it  going,  it's  available  at:  pay  the  stor>'  *» 

nt tp ;  / /www , s tephenking „ com/download .  html  0- 

A  French  judge  has  ordered  a  series  of  teats  ^  nrr  t  .u _ ^ 
screening  software  works  well  enough  to  reSS  ^ 

SoSbf tf ?hehSegorCe^fbit i°nUf 6 ■ aUCfcions  of  Nazi  mernorabSi^Frencflaw 

June  ordered  the  Web  company  to^ck^ess^o^he^uet^1"00^'  S°  a  judga  ln 
auctions  are  legal  elsewhe’**-  Y»hon! '..access  to  the  auctions.  Because  such 

fr.yahoo.com  site,  not  S^^ijfglobaf Yahoo  ST** ?\ ifcsm fiance-oriented 
that  it  doesn't  have  the  means  to'heeo  portal.  Toe  company  argued 

auctions  outside  of  f>  yahoo  com  ,  use*s  tZQm  acc«ssing  all  the 

should  be  tested  by  expert-  befor^he  m-v?«  ^^•Jacques  Gomez  said  that  idea 
com-m  fa,-«  r.Lk'  Dercie  he  ®sxes  another  rulinq  in  Auovst  v»b™r 

coaid  face  hundreds  of  thousands  of  dollars  in  fines,  0-  vgUot*  yahoo! 

in  an  attempt  to  get  the'  v~4i™a  comoan  *9  service  **ve  banded  together 
real-time  Internet  chatters . "rhe  MSN  Network  A hyge  cor^«ity  of 
Tribal  Voice  have  formed  a  coalition  C°T  ajld 

them  connect  to  its  m  service  that  wi*!  push  A0L  to 

group  might  end  up  with  the"covernmert~on  it-  tide  °f  ysers*  The 

many  that  the  Federal  Communications  CommissioTJili  cSnside^w^h-rtd®  °£* 

4.t  uOrds  a  hearina  on  the*  o^ano^d  Am  >>  *  COI3Slaer  or*  Thursday  when 

as*,  assr  h*s  - 

18  certain  its  IK  market  share  won't  be  affected,  'o-  U  y  Slvs  in  when  it 
LANGUAGE :  ENGLISH 
LOAD-DATE:  July  26,  2000 
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SHOW;  HORNING  EDITION  (11:00  AM  on  ET) 
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LENGTH:  584  words 

^  SYSTEM  TO  MONITOR  E-MAILS  GOING  THROUGH  INTERNET  fJERVIOF 
PROVIDERS  CALLED  UNCONSTITUTIONAL  BY  MANY  AWU&KNET  SERVICE 

ANCHORS :  BOS  EDWARDS 
REPORTERS:  LARRY  ABRAMSON 
BODY: 

BOB  EDWARDS,  host: 

s/sss1;?  tor  °» 

..ivest*gators  search  ter  evidence  by  sifting  through  huge  volumes  of  e-mail 
mveJ-icat^on  ?h Trnr^K^™1?0™  e^oses  law-abiding  citizens  to  an  FBI " 
be  trusted^because  °f  Coa9res®  >'«sterday  that  the  system  can 

Larry  Ateamfon  rejects  ^  nSS  m8ssages  Levant  to  investigations.  NFS' a 

LARRY  ABRAMSON  reporting: 

o&uet liy  the  FEX  ssks  Intsrnst1  r!»r«  *» •> 

*«,*.**  „  Ttvv.  ;  \r  providers  to  do  its  eavesdropping 

th-  h“  b*ra 

With  special  <snefwa^o  •ru.-l'-a-  ~~  “  na®®'  vw.^.y.e  is  gust  a  computer 

Internet  -e-v®ce  n^vi^Jh  installs  the  system  in  the  offices  of  the 

eve^t  X  L?:  d  *  e  a  biS  vacu«®  cleaner.  Carnivore  sucks  up 

^  ™TfTSe. **nt  or  received  through  the  provider.  But 

che  fS  bits  th»t  aLSre?”fA1  *erf«'  c*ralv««  sPits  °«t  everything  except  for 

une  *>aCS  tnat  are  .r£d..cttod  to  the  investigation. 

Mr.  DONALD  KERR  (FBI }  r  What  it's  K-isir^viv,  *. 

the  addre^R  0  ,  s  oasxcaA*j  allowing  as  to  ao  is  record 

outside* of  the  envoi one"  fS  8?lt  and  th®  return  address  on  the 

f3«  do  rot  ft*.  L  not  permitted  to  read  the  subject  line  and.  in 

U°  not-  capture  that  and  record  it, 

™^B^S0N!it,S  3  lot  hard8r  for  the  FBI  to  get  court  authority  to  actual iv 

*  The  fB3C  assured  Ria»bet's  of  a  House  Judiciary  J 

«ub-om»attee  that  Carnivore  software  can  be  carefully  tailored  eh-.t  ,■ 

usef  theLT^  °Lthe  5Tder  and  the  recipient  of  a^ssXo^  XgantsLave  Y 

GrefoS^  L& "S  °l  searches  on  telephone  lines  for  decades.  Kevin  Di 

3  _ ,  With  the  Department  of  Justice,  says  they're  very  useful  in  the  »arlv 
stages  of  an  investigation ,  *  Kltti  ln  cne  early 

Mr.  KEVIN  Di  GREGORY  {Department  of  Justice):  To  illustrate  law 

buvinaehffn’ftenin€e^  to  find  out  from  whom  *  <3«*g  dealer?  fir  instance  is 
It  is  tSrifi2ali£2t2?  ?l  to  whom  the  drug  dealer  is  selling  his  goods, 
communicating  P  an  CO  detemin®  Wlth  whom  the  drug  dealer  is 

< nf™f f nn :  *“  i8,Chab  th8  *****  has  to  peek  at  each  bit  of 

Saiiju  ™dr:yv  Kanhr“*srs  °£  «- 

SSJ  SS.?L2«d“r““  C  °"i0“  «•*»•«  th,  potential  for 

Mr.  BARRY  STElfJHARDT  (American  Civil  Liberties  Union) ;  Never  before  has  law 
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enforcement  installed  a  device  which  access  all  the  ■ 

service  providers  customers  rather  communications  of  a 

of  a  particular  order.  h  0nly  the  CORKRUn3-cations  of  the  target 

ABRAMSON Internet  service  providers  have  become  „ 

and  subpoenas  for  information  in  criminal  ;^.a«°^'CCUSt0^?  to  court  orders 
“W  say  they  t.str.t  th.  S“. “sf;S?*“L But 

K£Sr,SS  SS  T-—  *f =«&!£«£ *bS*2?/S"  * 

«-  s  2Lsr^iS^ssii^“ttori'»  «»a  “w« »»»»«. « 

is  w^r!5!^31' BAER  (Georgia);  you're  saying,  'What  we're  Croatia  «-r>  - 
is  we  re  going  to  go  outside  of  the  law  here  hsH«  ,v  w  ,  e  go;n9  to 
force  you  to  allow  us  to  out  «.»•  u  basically  and  we  re  going  to 

able  to  monitor  it.  It '  s  watelv  ™™  v  y®ur  ^ou  will  not  be 

You  just  give  us  access  and  we~ll  do  our  fhing?^*’  'ihmK  you  very  much'  fiwys. 

^“e^tSefs^nd^ma U^'courffhave^Sl  IntefT 

Butrstuart "^Baker^^f orme''tger'o^i^cou^sn'1B''^* rSV  t^iey'  ^ilibe  Seriate. 

extending  ...at  analogy  to  Internet  service  providers  doesn't  make  S’ 

Mi  v  STUART  BAKER;  To  say  you  don't  have  an  expectation  At  r-rn  w 
information  that  i«t  in  the  ku-  ^  expectation  of  privacy  in 

r  "  1  oe  ndkJ-as  tne  thxra  party  in  the 
j  ttt  crazy.  X  mean,  our  enti  re  Hvpr-  ,****  *.£,  N  ,  -  *  „  ;L^ine L  is 

'  A*ve«  ate  in  tne  hands  of  third  parties. 

The,iBI  is  offering  to  hire  an  independent  investigator  -o  n~o,. 
if  °f£ers.a  constitutional  way  to  wiretap  on  the  feterr^  n-i 

.ar,  vhe  agency  says  it  will  not  reveal  the  sfifr^r/^  i  u1  7^  &Jt  so 

Many  civil  libertarians  say' that's "h ih  w*v  *h  RQ  the  systea- 

that  Carnivore  is  dangerous  ^  ZT*i  a  thty  c<m  prove  to  Congress 

News.  Washington.  SCOuia  °®  abandoned.  harry  Abramson.  KPR 
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F?X  DPEJG>S  CSE  OF  E-MAIL  MONITORING  SOFTWARE 
BYLINS;  By  Frank  James,  Washington  Bureau 
DATELINE:  WASHINGTON 
BODY; 

technoloov  Iawmak®fs  on  criticized  the  FBI  for  using 

monitors  e-mail,  claiming  that  it  threatens  privacy  rights 

experts  Bf¥  those  concerns  miss  the  point :  By  its  very 
nature ,  e-rosi!  is  not  secnre,  Electronic  ^  ^ 

send  private  information.  messages  are  among  uhe  worst  ways  to 


a  comDuS?9™^  *,!£“*?  Pfpiary  subcommittee  hearing  Monday,  Tom  Perrine, 

*  h  fte  ratl  out  of  ti-e  before  he  could  explain 'to 
1-im.^s  v-ha-  it  3USv  government  snoops  using  a  special  secret 

software  program  like  ‘Carnivore*  that  threaten  e-raiil  privacy: 


w*th  *  little  computer  know-how  can  catch  and  read  other  people' 

coLffrr'  -rd  ofch*r  experts  say,  is  a  simple  encryption  ' 
program  wh«t  codes  tne  e-mail  so  others  can't  read  it. 


'li  everyone  used  s cron a 


encryption,.  large  parts  of  Carnivore  would  be 


completely  useless,  "  Perrine  said,  wouia  ^ 

doubtedhthe  ^Bl>s°abo^5i?9,'Dem^3:'ati\and  5ie*,ublican  skeptics  openly 

Kee^  fro-  abusing  its  Carnivore  technology  a^d 

telephone  Set ™  ^tutional  rights  with  the  Internet  eguivaie^  oCa 

to  capture  ,the  a??ncy  has  GUietly  used  Carnivore 

;t .rf.  't'T.  ajV  £r?m  of  e-mail  between  certain  suspects  and 

^Jr?d  authori?veSl^np2-£®fera^  judges  hav®  Provided  the  agency  with  the 
si  L  f  lf;°  hss  ca-Dnure~  not  just  the  address 
~n tor mat ion,  out  the  content  of  targeted  e-mails. 

,  f 1  i 'ra oy  experts,  lawmakers  and  others  have  sharply  criticised  f-he  p&r 

its  use  of  the  program;  Monday’s  hearing  was  filled  wi^ha^^i^!  of 
privacy  violations.  accusations  ot 

f^r  "t'ohter  r^?^Sf  haS  t0  *£c' ”  said  ReP-  Jerrold  Nadler  (D-N.  Y. ) ,  calling 
°f  t- Shter  restrictions  on  the  FBI.  “Police  agencies  can't  be  afforded  9 

untrammeled  discretion,  and  we  can't  assume  a  lack  of  bad  intent  on  the  part 
Of  police  or  the  presence  of  goodwill  is  enough  to  protect  people's  priv^y!“ 

are^check-  andebffJnnfOUn^v'  Mrry  Parkiasor"  assured  the  lawmakers;  "There 
«w»  f  K  an<3  balances  with  respect  to  Carnivore.  ...  it's  not  a  situation 
v*hore  a  rogue  FBI  agent:  could  broaden  th&  covpr^o^  of  th&  "V" 

and  violate  the  court  order"  authorising  the  SeiflanS.  ®  ^tereept 

fcfhat  the  numerous  witnesses  defending  the  use  of  Carnivore  as  ~ 0 

SS^l^StS-!S?!SSift^?,e  ^ow®v«r,  was  tto thLa 

y  “'tJ-  agroe  on--v.he  insecurity  of  e-mail  in  general. 

President  Clinton  knows.  After  a  speech  last  March  in  Silicon  Valiev  s« 
s~nf  * S  l^Cl  kor'.  technology  columnist  for  the  San  Jose  Mercury^ews 

d>cxfioons  ssScsd  Clinton  xt  h©  fcoeos?  4r>  t“Anr»V!  ■<  ¥  *^ewst 

Chelsea,  by  e-mail  while  she  isaw^y  at  SanfSd  UniverSj.  ^  daaghter' 
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secuLf«nsai|°ciinton.Wifch  CheIsea'  ^olutely  not— I  don't  think  it's 

SupScoSter^entS^It  J*  «“  *»  «•» 

worries  about  protecting  their vf1  fotnia“San  Die«0'  everyone 
information  by  i-^il  computers,  but  too  many  send  sensitive 

ffoesThe!e'lr^i^Dtn'rf^  !^Sh  1  c??Id  re!seE^er  who  said  it,  bat  basically  it 
concrete  bunkers  surrotinledM^^rh?*  °V€r  ****  internet  is  like  two  people  in 
written  on  thf llrS  JSf”*  **  ^ 

«^SS.*iL2S*t  STSS  “n  *?  ”*a » 

said,  tIK  ana  technology  called  a  packet  sniffer,  he 

E-mail  transmitted  over  the  Internet  i^v*  -- ;  -t  ,  , 

«<*•!  M,  is  broken  into  JhSi!  billed  tte  . 

tovrJ”  tocJSL'tluZ  ^-tS1 'rSSS?  ch* 

»  f4,  w‘  *mck«ts  ortea  take  different  routes  to  get  fr«  »i>r Vfr 
point  B,  bouncing  around  the  Internet  until  thev  ar^ve  ?t  thfit  '\  " 

and  are  reassessed*  y  a  at  their  destination 

At,  uhs  right  pises  on  the 

sniffer  can  collect  the  o*ek^r«?  ki  someone  sj.se  using  a  pa  eke 

%  1  packets  tnen  reassemble  f  h**m  ta  la^vn 

an  e-ma.ii ,  reading  to  the  security  issue  Clinton raised. .  contents  o 

wi th'tcl™* f°r  foncertt  is  the  Possibility  of  an  inside  job  some— e 
„t,  «coess  to  the  powerful  computers  known  as  servers  t-he  ,  r 

networks ,  said  Richard  qmi  ,  cne  ora  ins  of  computer 

Mass.  °"‘Xl'h'  an  ^ternet  security  expert  based  in  Cambridge, 

* xn  the  case  of  Che  1  see ,  t  h«*  r  -  1 ~  u  _ 

the  Secret  Service  is  *  have  as  .*.  resident  Clinton  or 

t  ::  !:  service  xs  what,  somebody  at  Stanford,  or  wherever  v?h^ 
tne  e-mail  system  was  wafcchincr  that  tTaff-i  j,  .  i,  i^a^ntains 

tabloid  rnewwaoe-l  tf  traffic,  that  they  got  $10,000  from  a 

reason?"  be  said?*  ^  d  tb0Se  e“,Bai18  and  on  Chelsea  for  whatever 


Sensitive  corporate  informatior 
when  they  are  mentioned  in  e-mail, 
format* 


on  and  trade  secrets  are  equally  vulnerable 
I,  which  nas  its  roots  in  an  easy -  to-read 


anything  cried  out  for  heina  enervr'^^d  t  .  „  *  * 

said.  -Maybe  over  time,  that  cant!  ? cKgf^t Spens^^1  "  ««* 

allASmpuSr  Sf  t£olB  ar*  ™«^ly  available  to  virtually 

emplS  r  3  y  tSKS  SOme  knowled^  of  computers  to  properly 

®fpertS,  fo?*see  growing  consumer  demand  for  encryption  *m  c-n 
expect  that  as  people  learn  that  e-mail  is  not  secure  thereMl 
interest  in  using  encryption  to  protect  it  *  *aid  m  11  ore, 

scientist  with  AT&T  Labs.  “Most  people  now '  densest  ffse?rch 

interested  in  it  or  it's  urn-  IT Jt  .  usf  *c  oecause  they're  not 

that  comes  with  their  computer."  °  :'®®  113  the  standard  configuration 

an  ?2t?rnet  enSioeering  standards  grouo  recent ’v  dewi^ 

cases  this  would  be  transparent "'t^the^us!^"  h^aid*  ""hos^t**  ?nd  in  most 
they're  not  already  here,  are  at  least  on  the  horizon!"  **  technologies,  if 
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ACLUhforBa  ^trlversiL^-mil^no^fng^^r^th’r  privacy  **'*«*  ««3  the 
passing  through  networks  connected  to  the  "device  e:nail 

•Carnivore"  by  the  fbi  --  because  it  alt%  »? tu . aufobed 
dangerous  because  it  is  eatable  of  scanr < nf  °£  Piortr^tion  —  is 

along  with  the  subject  lines’ of  Li  a2d  receiver  information 

messaaes  ‘"'L^  mail  to  detents!  ne  if  those 

rtAv+s*'"'  oriw?xn  information  worth  saving  for  FBI  review  nnHif*  *, 

Carnivore  s  almost  unlimited  access  to  Unlike  phone  taps, 

potential  for  abuse  by  ov^-ealous  FB?  S??®S  c\rries  «  high 

targeting  users  not  suspect  of  any  Lile  axAOWS  tb*  Possibility  of 

information  from  ISP's  on  rv'ssi  hi  e  <  n  tLl  ?  'e  1  lnes  or  gather 

electronic  mediums  like  e-mail,  but  .■■'arnivo^G^'G^  varrxed  °ut  over 
system  is  an  untouchable  box  frioc*i  more  Pervasive.  The 

information  nassW  fW«w-  °;lea  on  P^vate  networks  to  collect  all 
h  -^gn  passing  tnrougn  them*  This  is  nw®  ^  *** 

listens  to  everv  phone  co rve^f<  ‘  ^  ?  ^Su*Uing  a  aevxce  that 

calls  should  be' monitored  bv~laheL^h^!;erR1Se(.Wbelher  or  not  the  Phone 
workings  of  Carnivore  remains  sketchy’  lnforir,atfon  °«  th«  inner 

like  Representative  Bob  Ba-AhgA?  LGltL  S  prxvacy  advocates, 
•Frightening. -  '  tK  *  *no  haa  one  word  for  the  system; 

independent  groups ^who^wouL^exemi^e^i  of  Carnivore  to  be  perused  by 

being  collected  is  lira-5  ted” to  IwnLrrtl—***”??  to  make  sure  the  information 
This  seems  a  viable  solution,  artbelpteg*i*vofSth-°r  *°?  illesal 
not  be  violated,  yet  could  still  be  mentored''  wL Carnivore  system  would 

Carnivore  could  be  reviewed  by  independent^  OTWr^hTST*?  Friday  that 
enough.  '<w.t,B,iac.,c  academics,  but  this  does  not  go  far 

turning  over  inforraatiop"o^*'rIhg?<9^Qf?xvor?  wc,“J<a  leave  ISP's  responsible  for 
practice  with  phone  c^anies  if ^Le^<on  of  P*  ^ieW=  as  **  the  current 
allows  some  decree  of  protection  * °f  xncriJ0lnating  evidence.  This 

widespread  electronic  surveillance?  d  58  a  reasonable  alternative  to 

More  sweeping  reform  could  come  from  Cooore*>«  ,  . 

S if  recfasendation  to  legislation  that  wouid^fiffcfff^fr10®^15* 

55i£  ?"""  p«™wi4iiu&S  to 

enforcement  is  limited  to  suspect  users  and  „„???  communications  by  law 
only.  The  potentially  abusive  Sure  of  Sfnf™  if  ff rt~a£>p5oved  *ar*ets 

learn  to  live  with  in  the  digital  aoe  Laf-fSfff  ?0t  som®thlnS  ««  should 

privacy  infringed  by  law  enforcement  agfneiee  inferested*in  theiv 

a  few  criminals.  y  *nceie&ted.  in  collecting  data  on 

heep  up  with  the  times  and  fully  examine  the  feasihi  1  i tv 
wide-ranging  changes  to  electronic  privacy  Outdit-Ji  1,?  feasibility  of 

oie2^agfsCwi^raCatiT  ^iVacy  Act*  whi^  allowf  for^l-timeL^er^n^^ 

ox  messages  with  a  court  order  mVf-  -  interception 

t«taojc«os  «*  ,lta  fOT  toPhSL‘-nk;  sSvSr“°nB  £or  n~ 
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Hill  wiretaps.  Carnivore  System  Faces  Fire  on 

BODY^" :  JOhn  SchwartE  '  Washington  Post  Staff  Writer 

Federal  law  enforcement  officials  defended  ’Carnivore*— the  FBI’s 
controversial  Internet  wi retan  evehm..  IZZ  e  **  s 

of  grilling  by  Democratic  and  ph  moi e  than  two  acrimonious  hours 

chilling  picture  o?  an  IntSet  ?W  w^iaarakerS  y**?***y,  painting  a 
terrorists  without  prSpS  s^iSance  ^  haven  for  c«**»  ««* 

anonSo2naeL^tedm™Tnic^*eild  pornography  to  each  other  using 

®  ™ufe*  encryptea  cossjm  i  cat  ions,  "  FBI  Assistant  ni 

told  the  House  Judiciary  subcommittee  on  the  Constitution  I  *frr 

financial  service  companies’  systems  and  steal  brsak  **to 

credit-card  numbers,  criminals  use  the  l  *2dre8#®8  and 

communications  to  commit  large-scale  fraud  on  victims  all  cv#r  tho 
terrorist  bombers  plan  their  strikes  using  the  Internet!’  '  *** 

Many  or  the  lawmakers  seemed  just  as  concerned  with  the  nf  •> 

enforcement  officials.  ’The  potential  for  abuse  here  is  t-e-endovs  “i  ■  PW 
Spencer  Bacnus  CR-Ala , )  .  “What  you're  saying  is  ’Trust  us!—  ^  ™P' 

taown'as"® ’ "packet^snif f er^*  Cw^frtK*®”98  network -maintenance  program 
to  quickly  collect  Sst  the  -S’  and  fr?at  sj>ecificity:-the  ability 

for  v  r  3x^.0  4.rom  information  in  o-mail  mossauss 

iqi  example,  and  not  online  bankino  t r^nescHAne  ^ 

the  equivalent  of  the  teleohonV  :  V  X  gxves  law  enforcement 

*  ^  t  /  ^  ut,^epiio*ie  world’s  "pen  register"  and  ^ ^  „ 

aa.a-the  origin  ana  destination  of  all  calls  related  to  the  subject . 

Civil  liberties  arouos  and  ^ 

ScrrS?c^tf°?f^lWhat  ®^**£’*  reasonable'  slarch  enfseirurflf 
newteciloiogy  also 

5SSt:n  “tS  °£  information  from  innocent  pooplelfwell^fthe' 

The  critics  also  note  that  pest  experience  has  t- u - 1-  a-..  . 

has  overstepped  its  w<  >  na®  t>nowa  that  law  enforcement. 

iltu  iCB  w-kietap  authority  numerous  times  in  the  past. 

£ailaf»yhf«ei‘nht^dt'  4,ssociat®  director  of  the  American  Civil  Liberties  nn-io- 

of  accesSng  t'e'co^entf  o?1^  iS  rOU^  bivalent  to  a  wiretap  clpSlt" 

customers^nwithetherl‘'assurance^€thatVtheaFBinwil^  ^5^  company^ 
the  specified  target."  FBI  record  only  conversations  of 

the  netlorkn^TheJ  want 

^  publish  information  on  the  software  used  so  that  ISPs  can  hl  ™!f 
that  it  does  what,  the  agency  says.  Xb  can  sure 

..  Jbe  la?  enforcement  officials  pledged  to  present  the  system  to  a  nent-^i 

thira  party  for  review  but.  said  thev  cannot  „  ays  own  to  a  neutral 

the  system  that  it  will  b»corf>  .»  b  release  so  much  information  about 

'  Wiil  become  a  target  for  evasion  and  hacking. 

They  insisted  the  Carnivore  system  actual lv  nrmri^.  ..  , 

what^the  S*?*®  f  ^atherinS  electronic  information  because  U  can^iL-June 
wnat  the  machine  nands  over  to  investigators.  can  -ine-tune 
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job ar2*rm,t  *risk  their  integrity' ***** 

b.  Barr  Jr?  ‘  < R -Ga ?* f " twrcongreLS^ra rlly  Jrth^sfme^idi^f '  Y‘  >-'“nd  Robect 
Nadler  peppered  the  off-iHaie  t.^v  "' '  <  *  OT}  UaC  same  side  of  an  issue. 

point  that  Carnivore,  under  the ‘law-  ?K  nations  that  underscored  the 
could  be  used  withnnr  ,  ;'hQt  S°v«^  pen-register  surveillance 

telephone  wiretap  "  dlf£lcalt  **«*»ff  <>f  "probable  cause"  required  ?;  a 

said  theCclStoneaSSt?ation  asseJt^that^'we  don't  *"”**£  *nd  scornfully 
track  of  our  own  e-mail »  . asserts  “at  we  don't  even  know  how  to  keen 

!  r  e  mail  whi^e  'now  we  see  a  very  soohisti  oat-ed  c  £ 

keeping  track  of  other  people’s  e-nails  < «  y  “^Pn^scicaced  system  tor 

After  the  hearing.  House  Majority  Leader  Richard  v  n-r-m*. 
statement  saying  member1;  of  hni-h  n-tnl.  ^  K*cnara  K.  Armey  issuea  a 

administration  is  i nf  ringing^  *Stron?  ccncerns  that  the 

against  unwarranted  search  and  seizure  ^  constitutional  protection 

Jtiv.il  these  concerns  are  addressed,*  he  concluded  ■  ,  ,  . 

shut  down. “  ^u.c»^oea,  carnivore  should  foe 
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a^n?:«La*Tk?r*  rip  FBX  e”mail  tracker; 

Surisillance  tool  employed  25  times 

B0DyNE:  Wliilala  Gianz;  THE  WASHINGTON  TIMES 

Ca rn!mro f  ^  orcement  agents  say  they  have  used  the  contmTOrciai 

2 ™.SO£tWe  pro*r«  t0  e-mail  of  susp£t? asISSTTSS  past 

ll&gllK°r'tV&Ck*&  — tl  they 

Despite  the  restraint  the  FBI  savs  it  k*« 
criticized  law  enforcement  agents  for  Privacy  rights  advocates 

ss?tei-  *tout  “• 

Carnivore  should^be  suspended  urt^V^cerr-^o^13'^'  Sai<J  yeseerday 

law  enforcement  are  reconciled,  **  0t  Privacy  advocates  and  needs  of 

Until  these  concerns  are  addresser?  f*  «'*-*»<  , 

said,  -uu.fejea,  carnivore  should  be  shut  down,  ”  he 

Carnivore  enables  Inves tiaeto^s  to  nirt  ~ , 

traveling  through  an  Internet  ^r-iCe  P< flc  e”maU  messages 

monitor  who  a  suspect  conta^c"^/^  provider  s  computer  system  so  it  can 
4eCv  contacts  and  who  contacts  a  suspect. 

Hr,  Karr  and  other  federal  officials  sa>d  ^ 

system  is  crucial  to  he  Id  the**  m  vyut*  , e  high-tech  surveillance 

breed  of  tech-savw  criminal  *T  an^c^uc<  *1  ^ncf?aSi^y  sophisticated 

.  «*d  crucial  to  help  tnexn  keep  the  Internet  safe, 

foeginning°totappear  on  line  '“’^aa^d^out^^-^  in  th®  Physical  world  are 
Di Gregory.  ^  '  8Axa  BsPuty  Assistant  Attorney  General  Kevin 

If  we  fail  to  make  the  Interrupt-  «- „  ,, 

Internet  and  e-commerce  will  decline"* tndargerinaS«-hen“X<3enve  *5  UBing  the 
the  information  age.  .  .  .  Carnivo-4  9  t^e  very  befits  brought  bv 

used  on  line  only  under  narrowly  defined  -if?1*  ®n  a»v«*ti«ative  tool  that  is* 

* uct  °£  ci«*»  *>«*  **>•»*>  „„  i„ 

*  he  potential  f  or  abuse  here  ARrtvvnn\}et  «  *  « 

Alabama  Republican.  ~  '  enormous,  said  ReP-  Spencer  Bachus, 

Mien  it  is  usedf'^Kr^^^Ker^^afd^aSe0^  Sfif  Carnivore  is  a  little-used  tool 
are  caught  collecting  more  dato'tton  alloSed^tSv  Jan  ,care£ullv'  *W»  if  they 
five  years  for  committing  a  federal  felony.  #  can  hm  to 

P&s&t  we've  had  many  agencies  go  havond  p  ,  ,  , 

authority,  *  said  Rep.  John  Conyers  Jr. ,  Scffi De5c«tP  th*lr 

Mr‘  ferr  ^  FBI  and  Depapt«  «£  d-tice  will  seek  an  independent 
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review  of  Carnivore  this  year  to  show  they  aren't  misusing  the  program. 

forLusi^eSrn?lPrivry  ?ights  adTOcates  also  criticised  federal  official 
tor  using  Carnivore  when  Internet  service  providers  could  -?««*■  =c 
collect,  information  being  sought.  iS  COUAd  3ust  as  easily 

„  *7^®  ought  to  be  more  control  in  the  hands  of  the  Internet  service 

providers  >  said  Alan  Davidson,  a.  lawyer  with  the  District-based  civi* 
liberties  group  Center  for  Democracy  and  Technology 

Ciiat  iew  nation's  estimated  10,000  Internet  service, 

providers  Lave  tbe  rft0tHlS  to  •sift-'  jc  r  *  -  U  iservyce 

law  enforcement.  through  e-mail  traffic  and  collect  them  for 

But  Hobart  Com -He  var  e f  an  Attorney  who  am  t  ^  ~ 

service  provider  EarthLink  said  represented  Atlanta -based  Internet 

iVj-.  £  j  %  •»  '  «rct  M0i,  ttXink  wajp  oa tberxiic?  e --tndi  1 

the  federal  government's  request  earlier  this  vea.-  wW  u  „  *x  2Flt0I,n?tlon  at 
comply  with  a  court  .■  >. ..  ,  .  ■  yea*,  v. r. c . ,  it  was  forced  to 

computers  5  of£icials  insta11  Carnivore  on  its 


mes2gefdKrai  Cotf^f  was  .*fset /hat  Earthhink  was  capturing  few  e-mail 
manages,  Mr.  Corn -Revere  saics,  and  it  needlessly  installed  Carnivore. 

s . , Mp'-i -  r.~  > ber s ^ es  Uru®n  Associate  Director  Barry  Steinbardt 

ofgf s  source  ^  made  public.  The  source  code  is  the  a- 

ox  i*.s  v4.uct4.ons  a  proorammer  wcitj3*«  . ^  ; ..  . .  ■.  ,  .  — 13  — J ■■--  »v. 

capable  of  retrieving*  «r>he  ACut  V‘*AA  *how  Just  what  Carnivore  is 

-earnest  ‘t  w"9I.  t  -F  J  s  tiAeo  «  Freedom  of  Information  Act 

- u.jjesv  w»tii  vhe  J-Bu  to  get  the  source  code, 

1  «wmaker«n°o?te^fy  ?  rafc  of  'Suestions  about  Carnivore  and  its  use 
-awmakeis  yesterday  didn't  express  any  willingness  to  make  immediate  eh^o« 
in  the  federal  government's  authority  to  use  the  surveillance  pwL?  3 

“We  should  be  sensitive  to  .*r»v  nnfat.cui  „ ..  ,  . 

Even  a  system  designed  with  the" best  of  Intentions^ 

essential  law  esif or cement  rync?  1  x  carry  out. 

not  oroneriv  2?*  S?.  *  catt?e  for  concern  if  its  use  is 


not  properly  monitored, *  said  RepV 
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REPORTERS;  JIM  STEWART 
BODY; 

SHARYL  ATTKISSON,  anchor; 


First  came  wiretapping  phones, 
cybersurveillance  program  called 
Stewart  reports. 


Wow  the  FBI  is  using  a  controversial 
Carnivore  that  wiretaps  the  Internet,  dim 


JIM  STEWART  reporting: 

user-erLdatheSFRT  X*V  MUf0t\e“!t!aiis  are  sam:  received  by  computer 

ou v'" ' Bu t d*- hft  tinM criminals  are  now  just  as  fond  of  them  as  the  next 

fhl  J  ,  agentS  has  alwaY8  been;  Just  how  do  you  sort  through 
,  SAbberish  to  find  any  meaningful  evidence?  The  bureau  told  Congress 
it  thinks  its  found  the  answer  in  a  software  program  called  Carnivore. 

unforton«rtRrL!ARK;IKS0K  (Geaeral  Counsel,  FBI!  :  This  is-. despite  its 
unfortunate  name,  uhis  as  a  tool  that  xs  very  surgical. 

STEWART:  Essentially,  Carnivore  is  like  a  wiretap  on  the  Web,  Phvsic&llv 
r^om  n?thin?  *°re  than  a  sm&U  coaster  the  FBI  can  lock  inside’ the^witching 
internet  service  provider  like,  say,  America  Online.  But  instead 
of  jading  every  AOL  customer’s  e-mail,  it’s  designed  to  zero  in  and  record 
3ust  the  messages  sent  to  and  from  one  particular  e-mail  address. 

or  SrveilSc?^thDtMf°r'-Lab  Oirision'  PBI) :  We  don,t  do  broad  searches 
surveillance  with  this  system.  That's  not  authorized  by  a  court  order  and 
m  my  view,  could  not  be.  v  uiue‘  <sna' 

STEWART:  Critics,  however,  immediately  asked:  Who's  watching  the  watchers? 

Mr.  ALAN  DAVIDSON  (Center  for  Democracy  &  Technology) :  Carnivore  has  access 
knowU?tr^  xnfof,atio?  than  ifc  is  l«sr*lly  ^titled  to  collect.  How  do  we 
put  on^Carnivore?  Carnivore?  How  do  we  know  what  kind  of  leash  has  been 


b^tween^wIrisifn^S  for  the  skepticism  is  because  there's  a  big  difference 
the  Internet  and  wiretapping  a  telephone.  If  the  FBI  wants 

thebnLnS  Ph0nv'  ty  get  a  court  order  and  SO  to  the  phone  company,  and 

the  phone  company  makes  the  connection  for  the  bureau.  If  the  FBI  wants' to 

wiretap  your  Internet  address,  they  get  a  court  order  and  then  they  can  make 
the  connection  themselves.  y  mak€ 

hackers  ^ndTL^orLw1!1?3!^-®  ^®*r  alr«ady<  mostly  against  Internet 
hackers,  and  the  potential  list  of  suspects  and  their  crimes  is  growing 

alonJ  isaS^2ctJdULytonS?n?°f'?r'  the  of  commercial  e-mail  messages 

Washington^  Ct  d  &°  tOP  blllion  a  vest.  Jim  Stewart,  CBS  News, 
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advocates  and  technology  experts  yesterday  blasted  a  new'  FBI 

thS  Interiiet'  sa'/in9  the  system  allows  agents  to  mnito-  e- 
mairs  of  people  who  are  not  targets  of  criminal  investigations. 

mniion/of  fn^-y0“  t0  tru?t  “3eni  with  ^supervised  access  ...  to  literally 
t  Barry  Steinhardt,  associate  director  of 

the  American Civu  Liberties  Union,  told  a  Rouse  subcommittee  <rZes*iaZfL 
the  system.  "For  me,  that’s  an  enormous  lean  o*  ; U  tu- Z  v  ago  t  ing 

asked  to  take."  "eap  °*  taich  that  the  public  is  being 

The  e-raaxl  sniffing  system,  known  as  "Carnivore,”  allows  i»v  ^ 

Oi. facials  to  sift  a  suspect's  messages  out  of  the  s<-r-«am  of  «,  • 

through  an  Internet  service  *  stieam  of  aa..a  passing 

„  «>.  provider  USP) ,  nke  America  Online. 

-har4SSt?iled^n  ?he  IS5  nKtwork'  Carnivore  can  monitor  all  of  the  e-ail 

.Si,  a®-)  vhe  list  of  what  is  sent  to  the  actual  content  of  the  e-mail."" 

¥2?  ^he  subcommittee  on  the  Constitution  that  Carnivore  differs 
^  ^ ^cauu*y  traditional  phone  wiretaps.  With  a  oh  or »  mrprSv,  Zu 

must  obtain  a  court  order  to  mon<  lt"n  t  P^oua  wiretap,  whe  tt>x 

* yi f n  t  e. w  j.  -v n\ er ^  1  on  &  of  a  specific  Phono,  Then 

contacts  the  phone  company,  which  installs  the  tan,  end  when 
investigation  ends,  disconnects  it.  Agents  are  not  able  to  morito^  ^ 
conversations  other  than  those  on  the  one  phone,  at0~  ai"y 

Under  the  Carnivore  svsfce^,  th^  fpt  fir «?+-  j 

^  ^  -  nrst  gets  a  court  order  to  use  tho 

agt.nc>  s  oO*.tware  to  tap  into  the  lines  of  an  ISP  Ur'H  J'e  ^ 
wlret&D  with  «  f  onriKe  a  tiacutionar 

-  to  only  one  pnone.  Carnivore  has  access  to  ev*rv  me^saar* 
being  sent  along  the  ISP-s  svstem.  In  addition  the  top  ^  f^s^ge 

Knowledge  of  what  the  FBI  is^ monitoring,  fc  h  u°  COf^r°l  over  or 

Sachoy  president  of  XCONN,  a  New  Haven ,  Conn, -based.  ISP  d 
Carnivore  violates  the  rights  of  ^4^ZZZ»  Z  Si*ld 

Internet  to  send  e-mail.  9"“  y  ls*w~atold^g  citizen  who  uses  the 


court 

common 


the  members  of  Congress, 


ges  from  and  to  you. 


Sachs  said  the  software  used  for  Carnivore,  which  Is  secret  bH, 
other  throats  to  ,  J  ,  ■  ^  .  ^o-crec#  Siso  po^es 

vulnerable  to  hackers  .*  toother  problem!  hi  said,'  i^tha^the^Carnivore  al 
&L?®  service  problems  for  several  ISPs ,  causing  them  to  stop  or  slow'  7 

Ju^ice  department  and  FBI  of  ficials  said  they  are  simply  trvino  to 
preserve  their  ability  to  mon^  i'fir  ~r<  t,3i  **  » ,  ,  ,  ,  ^  ymg  to 

is  being  eroded  by  the  arowino  use  of  new  technolooies  that  ca?ability 

cell  phones  and  wireless  message  device!  technolo3^  SUch  as  ««*W>txon, 

protects  privacTfoecfS^Tr3^0^3^  a^orn6y  general <  sa-i&  Carnivore  actually 
Protects  privacy  because  it  can  be  configured  to  identify  only  the  senders  and 
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only  tb*  a*“  wi*t.a 

machine  has  culled.  '  *'  h  huroan  reviewers  £fce  onl>'  what  the 

it  s  not  just  a  situation  where,  us  X  -if  » 

for  example,  could  broaden  the  coverage  of  the  Carnivore  4 nr „;rl,.3  agent, 
the  court,  order,  ■  DiGreaorv  said  •ln  L«-  n  arid  violate 

engage  the  aid  of  technical  people  dpS  f°,  hft-  ht  wou3f  need  fco 
Internet  service  provider  *  P  P  '  perhaps  even  technlcal  People  at  the 

Donald  Kerr,  director  of  the  FBI's  comouter  lah  divi  «■>-,„  „a  >  ,  ,, 
used  only  when  an  ISP  cannot  oi-oiria^  f-£~  • U*  r  dtvisron,  sard  Carnivore  is 
order  ^nnot  Provide  the  information  requested  under  a  court 

oraer.  ihe  rBi  would  prefer  to  let  ISPs  do  this  »rv  w,t-  *  -  l  lc 

not  possible  and  in  those  cases,  we  bring  in  Carnivore, »  he  said  ** 

of  Internet  surveuLS!^®  *b°“t  What  StaRdards  «W*V  different  kinds 

Last  Monday,  the  White  House  announced  the  administration  wi 1 >  n™„„ea  ’ 
legislation  to  “harmonize-  the  laws  of  wiretapoing  as  it  tffe-t-  tw*  P 
technologies  by  which  people  communicate  -  such  at  *  ?he 

and  high-speed  broadband  access.  telepnone,  dial-up  modem 
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A  powerful  cadre  at.  House  Republicans  today  demanded  per 

tne  plug  on  at.  controversial  e-mail  surveillance  devici  ''"Carnivore  "  P 

Given  the  uproar  Carnivore  has  created  x-ns  +■?■>»  ^  ■  , 

s  Sr";2rL“?:?.k«r  9°  «■«“«««  in  t; 

i  =,-r,v,^  -  :  y  A*">u®’  ii,voivea  nave  been  satistactorilv  answered  »  fv„ 

lawmakers  wrote  an  a  sternly  worded  letter  to  Attorney  General  £^t' Reno 

^exf-gnandbM  ^blicsns  inking  Majority  Leader  Dick  Army  p. 

*exas,  and  Majority  Wnxp  Tom  DeLav,  R-Teya*?  *od«v<«  i <2  Y-  *  '  • 

forcing  the  Justice  Department  to' move  ouirViv  ®.  a  13060  afc 

constitutional  concerns  raised  bv  mL  ?r  ^e*Slng  tae 

Armey  staffer  Richard  Dian^nd  told  CORCrw**8ial  de^' 

a"taCh  dir?Ctly  ^  an  Internet  service  provider's  intend 
sysLewtS,  carnivore  is  capable  of  siftincr  rh^ounh  ~  £  *v8“  !r 

messages  So  find  tho-,e  <-Cr  lly  wwough  vast  quantities  of  e-mail 

order  Hesga;;s  that  don"?  specifications  of  a  court 

nr^',v!  9  ltl-  m€et  chs  specific  parameters  of  a  elver  ceu-t 

order  are  -  according  to  the  FBI  -  never  read.  s  cuont. 

IntewhM Jro?Xf  that  the  F?1  is  si^ing  through  millions  of  innocent 

i%Z %; V  ^sers  e-aaia  messages  nas  spawned  a  oroundswell  of  oDDOs^tion  h 
the  £^ce*  Conservative,  and  liberals  alike  hive  decried  the  FB?>.  u-e  o  ' 
the  device,  claiming  tnat  using  the  technology  violates  cokH 1 
protected  privacy  rights.  v*^e^es  constitutionally  • 

"You  shouldn't  be  using  this  kind  of  (technology)  with  tM<? 
question  nanging  over  your  head, «  Diamond  said.*  h  type  o£ 

and^S8?"2e^^t0dfy'*  le“er  ask€d  *«*>  co  retire  the  device  until  the  FBr 
ana  vustj.ce  Department  can  adequately  address  the  nnc^,  f  "'le  *b- 

However,  Reno,  in  her  weekly  Justice* privacy  concerns  iv  raises, 

not  suspend  use  of  the  S5ice  Si?  aS  *  8ai<3  she  woyld 

is  completed.  ~  atter  an  sterna!  FBI  review  of  Carnivore 

-W.SEa^.£jir^,ri^  “sIcs»*ra  -?« «* 

u  in  tSha;£Slit  SMSS 

juSuiaLpSLsrtSiiSiSyto?oiSSof1to”*°“utiSMa  to  ”aic  £ot  tfce 

KBAS? 

The  Justice  Department  was  not  available  for  comment  on  today's  latter. 
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of  CarnivorehiS  month'  Reno  promised  to  personally  investigate  the  FBI's  use 
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BODY: 

far  -feared  Internet  privacy  legislation  probably  won't 

fr  th^B  congressional  session,  lawmakers  °  L  go  ver^ 

thorny  issue  and  will  ideally  be  ready  to  dev-lon"r~2?h?^«SK  X”  -he 
year,  Sen.  Patrick  Leahy,  D-vt.,  told  reoo^s  L.1  wv  ?  substantive  next 
leaders  today*  v  nigh-  v.ech  i  nous  try 

*X  don't  think  anything  will  be  don^  *.v> 

adding  that  Congress  should  fceoin forking  £,  yfar';  ^ahy  said, 

tederal  privacy  standards  next'Vear  ,on  se^tin3'  baseline 

has  a  chance  to  die  down  the  Presidential  election  brouhaha 

Despite  the  difficulty  of  establishing  arrive  .  , 

this  Congress ,  Leahy  blasted  the  notio "hf  y  -egtsiation  in 
congressional Xy  appointed  panel,  "  "  ^  -  wbe  privacy  issue  to  a 

^n^5Xf’Ve  SOt  $*?•  to  ^vestig&te  the  investigation*  o'  <rh,f(r 
Administration  scandals)  we  ought  to  at  ;  Clinton 

real -world*  on  privacy,  Leahy  said-  “*““t  4“*'uQ  '■**e  txme  :~°  ao  something 

7nXfndX5  Kouse  legislation  would  establish  a  comiss < on  '-o  d„'TO  . 

Internet  privacy  issue,  u-i>-S4'on  v-°  a«^re  into  the 

Although  industry  leaders  remain  lee»-y  of  » fx  , 
privacy  standards  without  a  fioht  th^  ”  Pvl  S  • !  A  Internet 

willingness  to  at  least  disou"!  a' SS  °<Tunity‘*  growing 
way  to  enacting  privacy  legislation,  “heahy  laid^^  Shoula  nelp  clear  the 

Business  «i  Capitol  Hill  where  the 

BSA,  which  represents  a  slew  of' large^ftware^Skb^®^  C^pion  **»«*■" 

whfsuppor^bte')"^  ^  Champi0R  statuettes*  to  L^akeS^SfrJSwo^ 
A*4°  suppor"  intellectual  property  and  anti-piracy  causes  **0ul«tors 

In  etdoition  to  his  work  m  the  » v-o^ &  *  .  . 

combating  software  piracy  end  supporting  the  relaxation^  ul****  kfY  roles  in 
on  encryption  products.  BSA  leaders  said  that  ™  f  export  CORtroIs 

thank  him  for  his  work  in  those  areas  Y  S  Leahy  Che  award  to 

whiff ihfsoftwrrfndulLf Solfnof f  *fWt,89U<»  told  Newsbytes  that 
privacy  standards?  the  Sp  wouM  be  Cfeaticn  of '  federal 

with  Leahy  and  his  colleagues  next  yearP  C  discussing  limited  legislation 

a.t"SLiL5,iSt:SiS  S«SS2‘SdS  K”£m,?  S  r?i '  »*«• 

fS;s?<o^ui/ederaidPfy  *Sis4suis«?cS  5i;bsc,uste8l"a 

legislation  would  preempt  harsher  state  and  local  measures 

Still,  BSA  wants  Congress  to  give  industry  self -regulation  a  chance  and 
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tasted811  reR>ainS  concerned  that  any  privacy  bill  nay  go  too  far  for  his 

HoillShsaidmiSht  SSt  8CSrted  in  that  process  thac  becomes  a  snowball, « 

^Xf  reEn^ks  today  ,  Leahy  also  addressed  "Carnivore* 0  the  FBI  *  s 
controversial  e-mail  surveillance  device.  0 1  don  *  t  think  we  rtMr>rt 
adequate  oversight  on  Carnivores  Leahy  sail  9 
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now  1.os  on  *»  the  Internet  as  naturally  and  as 
frequently  as  thev  pick  up  a  pnone.  Technology  has  created  «  < 

personal  abdications,  but  technology  is  aiL tlkfrn  L?  pSeSS,  for  * 
b^o“^  ^w^rf?l0ye£S  (to.  monitor  Private  conversation!  as  never 
^fv!cy.  WS  *USt  b®  updated  to  ^ress  these  new  challenges  to 

u&sl  week  the  White  House  proposed  some  limited  chances  to  ^be 
wiretap  and  electronic  privacy  laws  that  world  wvT  f  .  ‘  *  aI 

government  inh^ceDfci^  ^  e  1  ^oula  raise  legal  standards  for 

^  fe-mait.  separately ,  several  lawmakers  introduced 

e^oyers  to  employees  about  how  e-4ail 

In.e^e*.  use  ^,.a  pnone  cans  are  monitored.  Employees  of  The  %w 
Company  are  already  notified  u\  ine  iimes 

.  i  **  ■>  4-Xid v.  i,ne  company  reserves  t  h^  r-irthh 

mail  raess&aes  while  invest icati-u-v  *>  v  l  -  ignt  lO  * e\  i ew  e- 

^  v  <j  ^Ox«pj,3int ,  Last  vaax*  tne  cor^ns^v  j-;  ^w, ^  <?  «. ^ 

^  employees  —  most  based  at  a  reaionai  X*%7Z-  company •  dismiss eo. 

offensive  e-mail  messages.  ‘  ^  A  ^w.uess  otfice  —  for  sending 

Xn  ^e  absence  of  more  stringent  controls,  law  enforcement  «« 

conduct  wholesale  monitoring  of  digital  written 

f“  »3:M8  “  u,c»  -r.  on  hi 

ton  SStoi  u£  ?LCF  rf  2?^  l?,^lns «  posnibi;- 

“aii  on  the  network  of  an  Internet  service  provider.  Until  mw  hh  vTL  % 
power  and  its  potential  for  abuse  were  not  so  readily  available!  *  : 

Current  wiretapping  laws  -were  not  drafted  with  thi  ®  * j  .  .  -  , 

need  to  be  updated.  Various  ^t-c^o^ogy  ^.n  iuind  and 

secret  interception  of  ££9?%  co™J£r4*L- l\fePnt  1?sal  standards  for  the 
depend* no  on  Www  'v  . Cv— ^nicatxo.^  by  raw  enforcement  agencies, 

depending  on  whether  the  communication  is  by  telephone,  e-mail  or  cable  Modern. 

Its  plan  would  bring  the  standards  ufed  fortntercepting St8nCieS ' 

^terceSon'  T™  p?f8ct*v*  ievel  *»*  applied  to  telephone  wireSs^rllLa? 
caJe^SS  i??h  resulC  in  suppression  of  the  evidence  il  tfT 

^r^tS^sS^l^SdSdi0?!.0?  PhT  CaUt  The  pro^sal  would  alLtK 

r  tnv  Same  *egal  standards  that  apply  to  phone  calls  for  intervention  of 

^otection  bS/f^  Which  have  a  greater  degree  of  privacy  P  1 

protection  under  a  law  that  governs  cable  systems,  1  * 

administration  is  also  calling  for  greater  authority  for  court*  *•<> 

of  incomingeaSroutooLrS?' CS  ?**  d«v}c**  that  recor/the  phone  numbers 
mil  Sales  g  nS  CanS  aRd  tD  track  the  <»**»•  and  destinations  of V 

These  changes  are  clearly  needed.  But  Congress  also  needs  to  ^ 

safeguards  against  the  govermoent  <  a  wror.of.-l  "»oo  !AS°  r*eecis  to  Provide  nev; 
cm^-L'ik..  ,  r  s^vmuew.  s  wrongful  use  of  ever  more  cower ful 
surveillance  technology  against  law-abiding  citizens  :»rinM  , 

been  »Knnt-  t  y  witxzens,  serious  concerns  have 

sed  about  Carnivore,  the  new  online  wiretap  system  used  by  the  F.B.I. 


7>od. 
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to  track  the  communications  of  individuals  suspected  of  criminal  activity. 

inv2t ioati on  ^  2®  teC!moiog^  ca5?  iBDlate  the  e-mail  of  the  target  of  an 

2rvice92ovMef  aiSLSt2em'nWTen  h?°^  F  t0  the  network  o£  Internet 
i  v  ,,  provider*  gives  the  F.B.I,  unlimited  access  to  the  e-ma'  1  a f  *,n 

subscribers  on  the  network.  While  a  court  order  is  still  required  to  in2™* 

°£ .messages,  the  secret  technology  controlled  exclusively  by  la^'’ 
enforcement  raises  fears  of  improper  monitoring.  '  Dy  ia* 

£°^t£ne  government  surveillance  of  private  conversations  was 

fe2iWeto  e22L^aChCfUty  *1\hy  legal  ^straints.  Now  that  it  is 
be  2renotLnS  rf  eIectro“cally  °n  an  unlimited  scale,  the  laws  have  to 

because  technology  °*  4,11  0nline  C0“i<:sti0KS 
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HEADLINE :REP^CANADY  INTRODUCES  BILL  TO  UPDATE  WIRETAP  LAW=! 

BsLIKc:  CHARLES  T.  CANADY  ,  REPRESENTATIVE  ,  HOUSE 

BODY;  For  immediate  Release  Julv  2?  2eon  „ 

Update  Wiretap  laws  E-Mails  r  .  ep*  caiJaay  introduces  Bill  to 

Covered  WASHINGTON,  D.  C.  -  Re-  Communications  Would  Be 

House  Judiciary  Subcommittee*  on '►he  Const  it-lfo^t  i5“FL? '  Chairman  of  the 
Electronic  Communications  Privacy  Act  ^  0  t  introduced  the 
federal  wiretap  laws  to  cover  e-mail  and  sJo^'elecSn^^^^^ 
we*!  as  provide  special  requirements  for  aovltt^t  l r°r^  T  ^lonE'  ** 
addresses.  Canady  is  Joined  by  ordinal  ce^t^si  »  3»  f  e^axl 

S*g f,iun SP'f SS„L"“ ;?V’i*h «» JiS^StrSi 

not  answer  all  the  difficult  issues  r~lred'*hSy’  . Wllle.  tn.is  legislation  does 
it  does  provide  for  some  reasonable  technological  advances, 

rights  of  Americans.-  Earlier^ rtW  SLtn?  W*U  Protect  the  privacy 
Subcommittee  hearing  on  Fourth  ?ep'  '■'°nady  enaxred  a  Constitution 

■U  program.  The  Fs/desiS  anf S^^S*“f8-raiSed  b?  the  "Carnivore 

collect  communications  that  are~the  'wbStlf  int*£ceS*  and 

24th  hearing  featured  witnesses  f™  i=<,  court  orders.  The  July 

organisations,  privacy  organizations  and  ^epre*J'-ative*V*i  liberty 

The  Sloctronic'co,TOicatS  Privacy  £1  ofloook 

V^ee  sections.  The  first  section  abends  the  Iv!i  ^  ot  i00° 

also  exclude  from  use  as  evidence  ^  ^ fc *  exclusionary  rule*  to 

<*nd  illegally  obtained  *  stored  "  . 

elect  ion  ic  communications.  * 

i he  ho. XI  simply  adds  electronic  commm's'i , 

cove™1  «°“ications-  The  second  section  of" the  "f** 

government  to  produce  annual  reports  reoardinn  fcbe  fed^al 

?den-T^L°f  >’t0red  el^tronic  commu„iSoL!»  Thifr^L^S  the 

*.derivicai  disclosure  reguirement*?  fhp  Xi  te^iot-^s  virtually 

the  use  of  electronic  wiretaps.  “The ‘final  *ecf  reST*rding 

the  definition  of  *pen  mister"  ^  ^10<A  the  legislation  amends 

to  .llo*  the  M.htihc«Xr«r./?°  thee, 

requires  that,  if  a  pen  register  or  — ^  anw  X”  *********  ths  section 

an  e-mall  address,  the  federal  government  ^ushf?®f®^lce  is  med  to  identify 
that  -specific  and  articulable  fact"  re«™M „  f  ^  aemonftrate  to  a  court 
been,  is  being,  or  will  be  committed  *and  kfokarfo^-J^  a  frime  has 
such  installation  and  use  [of  a  pen  ^1**  ?^ftl0n  ^^ely  to  be  obtained  by 
relevant  to  an  i„v.,tl0ati™  ol  rLT^of  i?  *?iCV  " 
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It  s  iror.u  Chat  the  company  the  Justice  Department  Wnt-w  „„  ,  , 

up  is  crumhl  ina  cookies  wh *  1  ^  ^v>^  «Atro^*A  V  <  ax  cmrnc  worked  so  hard  to  oreak 

government  is  eating  raw  meat. 

Cookies,  as  ra&ny  computer  users  know  are  fcnf-e:  nf  *,  -  .. 

keep  track  of  visitors,  In  addition  to  code  that  help  Web  sites 

exploited  by  hucksters  to  learn  consumers  -  interest s' andtabit^^ti^t  v 
knowledge.  They're  an  immeasurable  source  of  ^rsonal  inforn^gon  their 

So,  it  was  welcome  news  recently  when 
software  to  allow  the  individual  user  to  block  a?n5,“nced  new 

little  tastes  of  their  private  lives.  c  AOm  or  ai-  °u  th®««  tempting 


IS  month?  ffwf  ab?ut  the  same  time  was  the  FBI’s  revelation  that-  fo-  t-h* 
j.8  months  has  »een  using  a  computer  nrn™i  „ :  ,  ,  ...  .  cnat'  *■<>*■  t.»e  past 

installed  on  the  network  of  ar  ria^natPivr^  cai1®^  Carnivore,  which  when 

messages.  The  potential  for  mischief  ikS°cook^e?a^rx?^*t*tillionS>,^f  e~tEiail 
Grandma’s  oven,  coox^e»  seem  like  something  from 

cousin  to  wiretapping  is  necessary,  the  FRt  sav-  tr 
ev er-mo r e~  s onh i *5 ^  i  a s.*!  ,  ,  ■* '  ±  says*  to  kaep  up 

arug  dealer  a  and  other  criminals. 

ihc  question  is,  how  do  we  make  'a'-^VtAvv^*  _  „  , 

cybercorrespondence  from  actual  or  probable  crook^a-d throuSh 
innocent  citizens,  members  of  unpopular  a^'m  <  *'h®  e7*llea  oi 

in  power?  ^  .  gr^  ups  or  j^o^ticax  enemies  of  someone 


missing  fund-raising  e-mails  michr^r i  in  A1  <****• 

A  major  sticking  point  is  the  decree  of  «av  that  _v.  .  , 

standing  m  for  their  customers,  would  have  Cllar^  providers, 

monitor  e-mail  traffic,  with  court  permission  ?Bx  would  prefer  to 

filtration.  Privacy  otouds  ,  **  ,  *  i^s  own  terms  with  its  own 

feds  obtain  ~  ^r^cp«  and  some  or  the  providers  suggest  instead  that-  *-h» 

J.ea„  ®.ain  «  court  order  a  ski  no  the  cotsoan « e-s  =--,^7  iT  1?  u*at  aie 
case-by-cas©  basis.  *"  *  vn"e^  jL01  specific  material  on  a 

w^^J»*«SS^Sm''Sd*2sj  S£SrrtSi°v.“hSJiia£i-!‘.or'e>,‘>“id  “oc 

&r£5%?23S.<2£ff  i"““  *■« « *SF!2£g,mS?£Z  SLX, 

Reprinted  from  the  Indianapolis  star. 
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???inS  t2  P?rman?nt:iy  Pyl1  the  plug  on  the  FBI's  controversial  e-msiT 

devroe,  Carnivore,  Rep.  Bob  Barr,  R-Ga . ,  on  Thursdav  'introtod 
legislation  that  would  curtail  Isw  ^  ^ 

of  Internet  users.  ^to.cers  rights  to  monitor  the  activity 

..  promised  earlier  this  week,  Barr  introduced  the  Digital  Privacy  Act 

?ech?o>oo^f3  updates  federal  wiretapping  laws  to  "bring  them  in  line  with 
technological .  oevelopnents  such  as  the  Internet,  wireless  phones  a£T 
electronic  mail# "  Barr's  otfice  said  in  a  statement  today, 

W»«.  legislation  would  prevent  the  FBI  and  other  law  enforce-* 
aCf . *»<^iduals «  computer  files  unless  "factual  evidence  & 

reasonably  indicates  that  a  crime  has  been,  is  being  or  will  be  co^itted. " 

f„_  electronic  evidence  illegally  obtained  by  law  enforcers  -would  be  barred 
troa  use  in  court  under  the  legislation,  0!iata 

is.  the,15t®st  “ny  s?'ost  tangible  attack  on  Carnivore, 
public  ea r  1  i er R thi s 1  mon t h ^ 0a° ”  *88<3  criCiCiS®  SXRC«  news  of  iCs  us«  was  made 

Designed  to  attach  directly  to  an  Internet  service  provider's  internal 
£®rRXVRr«  33  capable  of  sifting  through  vast  quantities  of  e-mail 
messages  to  Una  u>iose  that  meet  investigative  soerlf icat> ons  of  -  rot'rf 
order.  Messages  that  don't  meet  the  specific  ^  2  ^  L 

order  -  according  to  the  FBI  -  are  never  read  S  lL 

that  th®  FF  iS  si£tinS  through  millions  of  innocent 
the  device?econservativesSandeiiberals&alikeahaveUdecried  SfiStfSiS 
;Stected%fi™rUtr:  USinS  Che  teChn0l09y  violates  constitutionally 

L/jidor  Bair  s  l€0i$lstion/  til©  PBX  would  rot*  v 

»«»“!>*=  of  InMct  «1.»  »  SSSh*  SiS»l“vSic«  ah  the 

> c°^!L0f *CarR:iV?re ' ar<5ent  congressional  opponents,  Barr  on  Thursday 
o-»e  o-.  more  --ban  *5  lawmakers  who  signed  a  letter  to  Attorney  General  * 
J&nefc.  Reno  demand  inn'  & _ ► _  _  wn6ra.i 


Janet  Reno  demanding  ZCZ  ZZ"  Z  Attorney  General 

.  nec  x.eno  aemaudxng  ^hat  tne  FB^.  shelve  the  device  until  the 

issues  surrounding  its  use  are  resolved.  '  '  COF*kfcatut,xGnaj 

«n  r^L5be  Upf°a5  Carnivore  has  created,  and  the  potential  impact  repo-tn 
on  carnivore  coulo  have  on  consumer  confidence  in  the  Internet  we  urap"  v-*n 
to  suspeno  any  activity  involving  the  development  or  use  of  Carnivore  until 

2lSSS^SS!*ey  ““**  UTOlwa  fc*Ve  b*“  answered,-  S 

leaf «i ^  hfr‘s!:rin9ir13  unchecked  e-mail  surveillance,  Barr's 
egxslation  would  also  prevent  law  enforcers  from  tracking  the  movements  of 
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cell  phone  users  without  first  obtaining  a  court  order. 
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shettii1nIo^uSpend’-het^Tn®y  G^®r?1  *****  **»?  said  Thursday 
people’s  e-mail  while V'theria'/eofoic^e^°^M??n;l^0riri®  °f  some 
at  the  Justice  Department  “  S  S  ^  /^?ra"  18  under  review 
use  i*..  a,rfm  tZTZlzn.  ,'-ninK  Lhat  agents  can  still 

r  •<?ur:n?  <-h®  review  or  the  FBI's  new  "Carnivore-’  we. 

Reno  said  at  her  weekly  news  briefing.  -=rs.eI1!( 

Reno  said  it  is  TV~  v  , 

process  and  address  the' issues  raised  "bv Jit*plair3  the 

experts  and  others.”  she  said  she  ho-e^-v^ Vn u-P' Ktv&c^ 

'  r,  ; /tCVe^  will  foe  able  to 
“CjaiwSS  vhe&e  issues  m  a  thoughtful  way  and  resolve  them." 

Reno >  $  comments  came  amid  a  hyi^a  ,  * 

harden  on  ffeder-i  i  H  v  ***  wOri0'e^-j  co  increase  the 

^  *  enforcement  agencies  to  justify 

and  other  communications  *  "  4 

LANGUAGE ;  ENGLISH 
LOAD-DATE:  July  28,  2000 


S/24/02  Hdease  -  Page  §05 


Iwr.  *V/ 


Copyright  2000  National  Journal  Group,  Inc 
National  Journal's  Technology  Daily 

m  Edition 

July  28,  2000 

LENGTH ;  238  words 

HEADLINE:  PRIVACY;  Barr  To  Introduce  Digital  Privacy  Act 

BYLINE:  Drew  Clark 

BODY.* 


One  provision  of  the  legislation  that  is  similar  to  * 
proposal  by  Sen.  Patrick  Leahy,  B-VT,  would  give  indues" 
orscretron  over  whether  or  not  to  authorize  wiretaps?' 

Currently, 

3 udges  must  approve  such  reouests  so  i  ~  > _ _  * 

officer  swears  that  it  "i«  releva®r  V  W  enrorC8rr>ent 

*5  *•***««:  to  an  ongoing  investigation. 

Another  provision  of  the  bill  would  overrule  a 

last  year  by  Federal  Communicaf  i  ons 
commission  and  would  stop  the  government  from  tracking  the 

£t*eXHoutl  rtr--?'“ne  ?*®r?  without  a  court  order  .  “As  'the 
'*°Ub«  reentry  acknowledged,  our  wiretapping  laws  have 
«Sr  ^hind  Che  technological  explosion  of  the  past 
*3^oi^%2K£  *  t°“*r  CIA  agent  and  federal  prosecutor. 

Privac>  hct  corrects  some  of  the  most  glarino 
co». vr ad r colons  ano  loopholes  in  current  ]aw. 

As  systems  from  NSA‘s  Echelon  spy  project  to  FBI'-' 

sv»-veT?f?r>^Ve  pfove”'  technological  advances  make  large-scale 
Sw^vei fiance  easier  tmm  ever  before.  It  is  vital  a 

our  civil  liberties  by  making  certain  t^e  law  chano2s ^forever ** 

8arrSslidinS  F°UrCb  AJRendsnent  Protections  from  being  eroded,  - 
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BYLINE:  BOB  BARR  ,  REPRESENTATIVE  ,  SENATE 

S^~s»f53g  r* 

tS;S  IS  o?  So  h«  rs  *“«**‘«*  «*;'  Wt ,i 

privacy  ptoMctioi»'«a trlS  JhS'fn  ?fff“ t”  SKS,  T,“  f*“'* 

oucb  m  th.  lPMcr.cc,  wireleL  phone.,  Sa  eui‘c«lfe  Sil?“  <Jdvelow““' 

enforcement  to  reoort  on  its  interc«LlL ?tauie&  *  Wrung  raw 
addition  to  «-h*  ^ j-ritv.wpyton  vt  electronic  communications,  in 
, cl  or.  co  v.ie  te-tapnone  wiretap  reports  already  yecnb  red  > 
electronic  evidence  in  court  -if  U  i  I.  ^kp...  •  I  *tq,  I  e  3j-oc"  the  use  of 
government  access  to  theiderL  t*es*of  liJ-e9aj-AY-  >  Stop  unchecked 

reasonable  evidence  a  crime  has”b*l~  coaw^^ed^  ^>**s  there  is 

tracking  the  location  of  celV  ts^T ,  &top  the  government  from 
probable  caused*  the  *S&  Sus*  ordei‘  baseq 

laws  have  fall en  far  behind  the  °F  «*  tapping 

For  example,  under  current  law,  e-maiis  *eceW !e*s  ?eeoi  the^pa^  dsc«d«- 
both  traditional  -Z*  “yce"ve  less  legal  protection  than 

rs:  raoii  case*  telephone  conversations  *  ^  KJTVu„ 

Digital  Privacy  Act  corrects  scjm*  of  t be  ~  B  The 

loooholM  in  h  or  ii3°st  glaring  contradictions  and 

cS?XX  IL4  railA  -wct?yst"f  h°“  "“•*  ProJ*ct  »*oi«  to  fbim 

making  certain  the  isw~ch»n«es  *e  i..,,.!1  -a_d  out  csaix  liberties  by 

protections  from  being  eroded  »«  , !h  ^  E  l^T  I”1  r*9  Pourth  ^^ament 
r*i'  <1  >-\?  r'vs^  •  t.  *.  “  cieci/  Ba^  *.  continued ,  Barr ,  a  Meihher  o f  tha 

uJdic^aiy  Com^uttee,  has  served  with  both  n,wnrawo^*.  ^  HOwse 

Central  Intelligence  Agency,  1  u^pa roaent  o*.  uusuice  ana  the 
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HEADLINE:  Soaring  online  warrants  worry  privacy  advocates 
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”Ptoer  of  search  warrants  seeking  citizens'  online  data  has  soared 
during  the  past  few  years,  a  USA  Today.com  study  shows,  '  soared 

nation' fw  an  «»»ination  of  search  warrants  served  on  the 

&  ^argest  Internet  service  orovi der  Mori, — . 
surprise  to  federal  lackers  mid  ci£ I  M aS.a 
for  legal  reform.  ‘  ^  ns  ana  are  prompting  calls 

800  percent  jump 

Tne  warrants  ,r  served  hv  starp  i  ,v^  i  4 
nation  ur&m  - < ^  * -  *  ■  '  *'u  ^DCc‘;^  investigators  troxa  across  the 

suhwih discovering  the  identity  and  activities  of  A0L 
eou-t  S  A0L  J**  served  with  33  search  warrants,  according  to 

167‘inhfo8W«Rd '  V®I* .  *****  AOb  is  bas<ad-  That  number  jumoed  to 

a°G  ~vA  J'“  A"99  '  ***  increase  of  store  than  800  percent, 

throuS'julJ^liSriogJ  show!  lovas£i»ato«  had  s^<*  191  warrants  on  AOL 

Congress lonsX  leaders  informed  of  ?**?&  ^ £■ 

examine  legal  standards  appl ied’to  InteJn^  invesV ioatiS^V S&1°-  Y  wiU 

House  Majority -Leader  Dick  Armey  Cm™  4Vd  ®o? atlonsl  At  * 

whan  sn/tA  .  *vk*ittsy,  k  iexas,  said  police  need  to  tell  Con  a  r 

wt,en ,  why  and  how  they  perform  electronic  searches.  ^u-rLS!3 

a  1 1 4  44  &  i  4a  kuhw5?  because  they  believe  that  electronic  surveillance  o* 

4le4£444  43hly  yo’:ferf'4  tool  that,  if  not  tightly  controlled  4el44 
*'**es  against  unreasonable  police  searches.  ^ 

*SJe  do  have  reports  on  wiretaps,  1  Armev  said  *ww  cKni.i^i,  < 

S^'iSS.’”*' th*  *•  ***  to  Z'c£'  SSiSi'c.fSS^S.1 1 

««>iressia"  tMBSS'1;Lot”tS  Sj  •  !“ii“KrS5S?  °Lt^SS*«,  pSf0"?1"** 
“X  *•»*«“  «ui  i»  t™Jt  “SoS""1  ““n  “  tties  t= 

while  ot£lci«lw„hi»9ton  occupies  itself 

icnorina  anwhar  016  s.reax"tlroe  interception,  it  is 

a. 3 no.  mg  another,  possibly  more  important  point-  The  p.™n  •  ,  . 

nrot^tf  aft44e!S4es  have  been  delivered  hae'oSj  a  ’fraction  of  IL  * 
protections  afforded  an  ordinary  telephone  call  or  e-mail  still  in  transit. 

Searches  for  online  data  typicsllv  involve  . ~ ,,  _ ,,  . 

and  child  pornography  to  violent  crime  and  fraud8  5  '"T<m  harassn*nt 
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Chief  Of  staff  John  Podesta  has  pledged  the 
would  move  soon  to  protect  electronic  data. 


aomnxstr&tion 


extent  to  which  our  electronic  cor^soondene*'  d'  considering  the 

fnd.  information,  shouldn’t  '  fhW  count?^ as  (0 
Justice)  Louis  Brandeis  ^ores'iar’nwc^  oup. erne  Court 

and  effects  mentioned  in  the  Pourth^endment?*  **  *****  **  th®  P&pers 

FBI  downplays  concerns 

.s/ottegoSK  JSo^rigJ^S'cSfrS Ju i'T*”  ““  fto”d 

call.  confidential  as  a  personal  telephone 

t«SaKo;3”‘.lSSf LSTSifSi-S?:?  •«“  **t»  <*.  u»  „« 

search  wanant.  ’What  about  records  of  mv  tr«i*nrH».  lS3I®iS 

•I  can  gu  that  with  a  subpoena  (roti  .  g;,Sj  °  ba,“'  *’<’  “*«• 

*?.«"  '«**>»<*-■  !'■«  insran™  tN 
cjiuivVif/  ponce  asK  for  np^  .  *  -cauvrto .*  At 

subscriber  identity  ‘^teQ  ^formation  from  AOL,  such  as 

*UKkiwA-^  oxi^^ng  a* la  and  payment  history. 


To  comply  with  the  more  extensive  orders,  *Koert«  *»v  i«r  .  , 

a  great  deal ,  '  "'vrs  **“>  *  mus  t  hand  over 

They  can  get  all  information  *  MarV  £  ._ 

prosecutor  and  vice  president  for  cvber  law  ar  5?ob»f  ££^rJ,ed*?*1 
get  your  credit  card  data  and  eveVn;nh,  v f  „ric  4  Inv.egtity.  They  can 
a  record  of  what  times  you  dialed' Ln  where  vou  th  them.  They  can  get 

were  online,  what  activities  vou  were  enoaoed  !w  ZtJZ<^‘  flow  i0ng  you 
what  chat  sessions  you  were  in  and  what  ySu  Sil'there  •  ®iC*S  y°U  visited' 

onlSe^ut  llfvarrSaUy  ^erythin«  their  «"***»«»  do 

roay  keep  e-mail  for  two  years  or  mo  4'  policies.  Some  ISPs 

weeks .  And  that  will  affect  authorities*  abn^v^o  it®  ?£ter  a  few 
criminal  investigations.  ”  to  get  wnafc  they  want  in 

For  instance,  he  said,  companies  that  host  Web  sites  nf‘im  « _ 

the  numeric  Internet  addressed  that  v.f  -w,  weo  s,tes>  of^en  keep  records  of 
vi,uftr.«  TCD  auuxB&se.  tnat  hit  i-heir  sites  for  veers,  vet  onlv  th  » 

wsitor  s  ISP  can  disclose  which  subscriber  is  behind  that  number 

America  Online  spokesman  Nicholas  Graham  said  the  comoanv  „ 

on  law  enforcement’s  growing  interest  in  subscriber  records.  comment 
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BODY; 

Millions  of  people  now  log  on  to  the  Interne*-  as  naniraiiv  ^  r  „ 

yp  t  phone-  technology  has  cS',  revolution ir  Y 

CQiuiuuni. ca t ions but  technology  is  a  3  maV'nrr  •  1 1  *  **  P^*»onal 

even  employers  to  monitor ■  ^  ^  1 w  Pos^ible  for  government  and 

i  ^  x  T  ,  woiutoi  pr^-vave  conversations  as  never  be*  f  <*>-(* 

era  laws  must  be  updated  to  address  these  new  challenges  to  privacj 

wireta?5idW?LSon^^^fe’PS°^?ed  S0,8e  Umited  changes  to  theU.S. 
goven^  in^ce^ion^^a^d^^Lr?14  r*ise  Ie3al  standards  for 
legislation  *-#>  *" -  ~  "!kl  J' A '  fxmjarateiy,  several  lawmakersintroduced 

use  and  "phone  ca  1  Is  a  re^moni  tored &  °  “«>loyees  *bouthow  e-mail  /'internet 

rese5Ss0theSrighthtoKr^r'ewe-Sn8ro-s-aee  *lpf®dY  aotified  that  **»•  company 

»>5r  «?* « 2&SLS1,1  SS"i"KS?.L2!'“- 

ou fewness  oliice  —  f  c*r^;  „  au  ®  ->•  egAonai 

xU‘  Oi. tensive  e-mail  messages , 

«a*3  ??"“  s^s-rsKiSrofiijiS 

provider.  Until  now  this  k<nd  r>*  h1,  .  *\a?  Internet  service 

readily  available  *'vw  ^  p- ^  « >±Q-  x t. s  potential  for  abuse  were  not  so 

mind°andeneed'fo  Jfl?f  were  not  drafted  with  this  technology  in 

standards'  for  the  secret  erew^o/of  S€t  different  M  ' 

enforcement  agenc*  er*ln^  ^  S  tt  d™tlc  communications  by  law 
e-mail  or  cabff^dm.  IK  cUnton  325&£?<  f~icatioa  i»  by  telephone, 
these  inconsistencies  ti-c  v  XStr?£xon  xs  Proposing  to  eliminate 

■inter-e-nrhn « '  Pxdn  would  bring  the  standards  used  for 
^icercepuxng  e-mail  messaoes  uo  to  th&  7  f 

applied  to  telephone  wiretaps '  il?ecrai  i %prote?flw  A*vel  now 
suppression  of  the  evidence  as  if th^  Se 3 l>h°  i T^1  ■' WOuld  result  ia 
phone  calls.  '  s  n  case  *'ov*  illegal  interception  of 

reviweia^«f^^aCi°“  iS  Aiso  calliBS£or  greater  authority  for  court*  to 
review  law  enforcement  requests  to  use  device  rha?  caurcs  to 

of  incoming  and  outgoing  calls  and  to  track-  n,P!^  ?  °  fcbe  phone  numbers 

mail  messages .  trac*  the  ori9ms  and  destinations  of  e~ 

These  changes  are  clearly  needed.  Hut  Congress  also  need**  —  - 

safeguards  against  the  government  ‘  s  wrongful  use  of  ever  more  oowe^fnt^  nSW 
surveillance  technology  against  law-abiding  citLens  P°Wer-fuI  u 

been  raised  about  Carnivore  the  c;clJens*  Serous  concerns  have 

track  the  communications  of  Individuals  sSspec  tS^/crlm?  T*  ^  ?h*  m  to 

system,  when  hooked  up  to  the  network  of  °^..crlmx.lai  activity.  The 

the  prt  k  .  e  network  of  the  Internet  service  provider  nivor 

the  FBI  unlimited  access  to  the  e-mail  of  all  subscribers  ™ X  !  ►  '^9 

While  a  court  order  is  shii  ™,i„j  *.«  •  t  auoscriners  on  the  network, 
the  h  t- rorrV.i-i.'s i  -  6Qhi*.ed  to  intercept  the  content  of  niessaoes 

the  secret  technology  controlled  exclusively  by  law  enforcement  raises 
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of  improper  monitoring. 

now,  routine  government  surveillance  of  private  cowe*>sat<o«i« 
limited  as  much  by  practicality  as  by  Wal  eonst-*w*  •  s 

feasible  to  ea y  con^uainti>,  Now  that  it  is 

be  strengthened  to*prevent  moni  to^inc/of  ^ “n'kl?*'te<s  scei®'  th®  laws  have  to 
because  technology  Ss  it  easy  9  8l"  °nline  ^™nications  simply 
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CARNIVORE. 


laqnosTic  Tool 


jgg^?M.Qata  inte^ja&n^jMitj^  Statement  for  the 

Record,,  U*S-  House  of  Representatives*  the  Committee  on  the  Judiciary* 

Dire^S^rSm^^*0"’ °7/2</2800’  Oratory  Division  Assistant 

n?tW0lte  are  routine^  used  in  the  commission  of  serious 
criminal  activities,  including  espionage.  Organized  crime  groups  and  dreg  trafficking 

orgamzatfons  rely  heavily  upon  telecommunications  to  plan  and  execute  their  criminal 
activities. 

aS®f5Cies  t0  condurs  lawful  electronic  surveillance  of  the 
communications  of  its  criminal  subjects  represents  one  of  the  most  important  capabilities 

25S  to* SJ^jElSiK^"1  betevior.  Unlike  evince  thatcan  be 

^  ^  0f  ™peac,wd  ***&  aHegatiens  of  misunderstanding  or 
f!Csufvef  ^ce  evidence  provides  jurors  an  opportunity  to  determine  factual 
issues  based  upon  n  defendant  $  own  words. 

IwtLli*!11*  1pS-i03t^ for  squire  the  authorization  of  a  high-level 

SSSSrS£ «3S?£222taaliB*0,,e  theIocs!  Uni5ed  mm$  Attorneys  offices  can 

SJS2S?  °^iSmUu  te  fedeta!  «»*  J^ges  or 

0f  ^P^^iWWdWwn.  Hence,  unlike  typical  search  warrants, 

!^ra  eS  &W  !!lSau8,?nze<*  f0  approve  such  applications  and  orders.  Further 
interception  of  communications  is  limited  to  certain  specified  federal  felony  offenses. 

for  electronic  surveillance  must  demonstrate  probable  cause  and  state  with 
°^nst(s>  ***  committed,  the  telecommunications 
v*hM? tim  *****  communications  are  to  be  intercepted,  a 
description  of  the  types  of  conversations  to  be  intercepted,  and  the  identities  of  the 
pe^ms  commlding  the  offenses  that  are  anticipated  to  be  interSpl3.1hS,Snaf 
electronic  surveillance  Jaws  focus  on  gathering  hard  evidence  —  not  intelligence. 

4^d‘Cf  f  tfti3{.0the/  norTnei  investigative  techniques  wifi  noi  work  or  are 
too  dangerous,  and  must  include  information  concerning  any  prior  electronic  surveillance 

irtter^rtTn«*  w’,***^' ifi  rtusstfon.  Court  orders  are  limited  to  30  days  and 

SJSKBwaS  SfctSf *  ff»?e  0,**5'*  m  oi3t3ined-  ***•#  m?y  (and 
SrSmSLl!*^  t0  the  501111  Really  every  7-10  days)  advene  it  of 

interception  effort.  This  circumstance  thus  assures  close  and  onootna 
^  ela^™niosu,ve»iiance  by  the  United  States  Attorney’s  office  handling  fire 

traSnal  tS^SSSSS!*  **  ^  *■""*  *  0toinesi  tn^  ***** 

!•)  m^enf  yearn,  the  FBI  has  encountered  an  increasing  number  of  criminal  irtvestiaatian<s 
coTOnret^B^ffh^wf  «3|foe  Internet  to  communicate  with  each  other  or  to* 
foeS^r^5i?  ^,CttmS'  ®*V  foiemst  Service  Providers  (ISP)  lacked 

the  ability  to  discriminate  communications  to  identify  a  particular  subject’s  merges  to 
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Car^w^0”  **  al{  °<hers'  **" F8t  des^ned  aod  developed  a  ffiafinostfci^,  called 

•JJJ t0  toercept  ami  coitect  the 

J^aaSSS5*--. 

SSiSS*511* 


coun  order,  fs  reqtamd  to  imm  the  device,  ^  asststance* 6$  ^tested  by 


F85  controls,  H?e  omsi8W  from  internal 

Attorney's  Office  level),  aSbythe  Coujf  SfiSL^r ' i<5U8ftere  ,eve}  and  at  a  U.S. 
the  tool,  including  exclusion  of  evidence.  a?w3  * 

system  is  not  susceptible  to  abuse  because  it  ^  i®«  aR,es' The 

and  such  operations  am  conducted  as  (IS  t0  ,tista»  and  operate, 

cooperation  with  the  ISPs,  1  to  **»  court  orders,  with  dose 

N 

them  in  their  efforts  to  <w»trt«  wtf5  industry  at  this  time  to  assist 


dcint  Experts  KSSS  £?"•  *  an  **■*«**« 
standards  tor  IntelSSfS  P  rcsjx,l*s® t0  a*  Fcc  **8**on  to  devetop 

while  providing  enha^owTpIva^ ^eaimY <0  tewfuf!jr  ob,ain  important  Information 
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HViLlln  *??£«£  h  traffic  through  an  internet  service  provider  (ISP),  The  FBI  amt  ISP 
i  ^*^  %**£**  3n3Ccess  P«*  «*«  contains  all  traffic  from  the  suspect  named  in  the  court 
;  Order,  with  as  tittle  other  traffic  as  possible.  In  some  cases,  the  ISP  is  able  to  provide  the  FBI  with  an 
access  point  that  contains  only  the  suspect's  traffic.  F  me  rot  w«n  an 

3  ^mmercia!|y  available  one-way  tapping  device  at  the  ISP’s  access  point  This 

oPoSSfSm«v^?rf  ^  °fa  dat\at^e3ccess  P°inL  The  <ap  also  provides  eleetricatfsoiation 
to  prevent  Carnivore  from  having  any  fend  of  tmpad  on  the  ISP's  network. 

r«S*r!f*w<^!-tf?«lc  ^en  ^0WS  ,nt0  coition  system  where  it  is  compared  against  a 

male*  *hlf«hriilhrttfrfter  °,n!y  passes  authortzed  for  capture  by  the  court  order.  Traffic  that 

evS  stored  to  DermanenfmSra6 «  on  t0  be  to  Permanent  storage  media.  No  other  data  is 

me  httere  *  permanent  med,a>  hor  is  any  information  recorded  about  traffic  that  dees  not  match 


ni*]]f^!SSflava’}ati{f  tof?{  0856  a9ents  *$  also  made  available  to  the  defense  attorneys  during 
i  f!f«K^ery  Pntx'*'ss-.!n  addition,  all  data  stored  to  permanent  media  is  sealed  by  the  court  that 

(SeSSemiySrSteed  mSpQase  t0  a  ctiaiien9e’ 8  «*  0f5ier  &  &e  unseated  and 
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Programs  and  Initiatives 


2 


5/24/02  Release  -  page  ® 


TOTAL  f\04 


rtoom 

(enclosure!" 
McDevitt,  Qt  i 
Thomas 


;rf 


ERF 
ERF 

QT  ERF 
RF 

3T  ERF 
QT  ERF 
enclosure) 

QT  ERF 
osurej 
QT  ERF 
(enclosure) 


Section,  EST~ 

■  bC't 

&7C  -  / 


'  •'  %8l:  hUC. 2W7 

;  O  f,N>nrrr  r***  T  .  #*  * 

s>n  54m 

w‘v*h» 


:ASON:  1.5 


vL")wv[ 


Sif  Y  OH;  X 


S/24/02  Release  ~  page  §23 

TiiJc.  '*‘60  _ 


m 


developing  internet^interc^pt  cJSabili^iS0"3^6  f°r  reactiveIV 
capabilities  to  process  thi  LlSeJ  ?b»  Sub  the 

this  interim  contract  will  iecluSi  tL  lS?io2Sq-  1)  ?l5"8oiS 
oevelop, neats,  and  2)  COMnunication  protocol  dSSiopLSS V«f 


%>»* 


imxtea  to 


ows  tall  system  configuration 


amount  not  to  e x c e e 


BX  n 


above  would  liketfrequS?  t^ba^^V^33  SS  described 
;®  r a;5q?*fr>D  .  the  Eri9*neering  Contrae 
ipteand  initiate  an  interim  contract  to  h 
I  and  issue  a  purchase  order  for: 
for  the  tasking  as  described 
I  eoordl  na  ted  w  1 t  h 


[i] 


LEAD (s) : 

Set  Lead  I : 


FINANCE 


S/24/02  Release  -  Page  $: 


m 


5/24/02  Release 

Doc 


iO:  Etna  nee  From : 

Re:  (VT  mtrnmmm 


Laboratory  L j 

03/15/2000 


LEAD  (s)  ; 

Set  Lead  1: 

FINANCE 


mmmmm  -  o  raa 

JRAGONET,  and 


ML  WASHING^,  nr 
H^|^|Vin  support  of"  the 


BhhhmSh 


ira  contract 


Set  Lead  2:  v^/ 

LABORATORY 

AT  WASHING? 0 N ,  D Q 

(U)  For  in formation  c 

Set  Lead  3 : 


tionat. 

SSCURT 

t  Y 

AT  H 

ASHING 

TON,  DC 

(0) 

For  i 

n format ion  onl 

SE^ET 

5 


S/24/02  Rdeas* 


OICA-aa  (12-306) 


FEDERAL  BUREAU  OF  INVESTIGATION 
FGEPA 

DELETED  PAGE  INFORMATION  SHEET 


XXXXXX 

xxxxxx 

XXXXXX 


- *  “* Sk-  °“  «  mn  «  *•  -Mm*  wtare  M„  .A, 

O  Mnoas  were  made  pn  to  the  exemptions  indkated  below  with  no  segreeabie  material  available  for 
release  to  you. 


Section  552 

Section  552a 

o  (b)(1) 

□  (b)(7)(A) 

a  (d)(5) 

□  (b)(2) 

□  (b)(7)(B) 

a  fj)(2) 

□  (b)(3) 

D  (b)(7)(C) 

□  (k)(!) 

□  (b)(7)(D) 

n 

-  YV\*7 

□  (b)(7)(E) 

CJ  VJV.jwJ 

□  (b)(7)(F) 

wW 

□  (b)(4) 

□  (b)(8) 

o  (k)(5) 

O  (b)(5) 

□  (b)(9) 

O  (fc)(6) 

a  (b)(6) 

O  Ck>{7> 

O  Information  pertained  only  to  a  third  party  with  no  reference  to  (he  subject  of  your  request  or  the  subject  of  y  Jur 
request  is  listed  in  the  title  only.  J  ut  > 

□  Documents  originated  with  another  Government  agency(ies).  These  documents  were  referred  to  that  aeencvft  si 
tor  review  and  direct  response  to  you.  K  w 

— _  Pages  contain  information  furnished  by  another  Government  agency(ies).  You  will  be  advised  by  the  FBI  as! 
to  the  releasabtmy  of  this  information  following  our  consultation  with  the  other  agency(ies). 

-  Page(s)  withheld  inasmuch  as  a  final  release  determination  has  not  been  made.  You  will  be  advised  as  to  tht 

disposition  at  a  later  date. 

.. —  Pages  were  not  considered  for  release  as  they  are  duplicative  of 

^ _  Page(s)  Withheld  for  the  following  reasonfs):  OS^y  ^@0 ylS  ~-> 

. aW 


_ 


yC  The  following  number  js  to  be  used  for  reference  regarding  these  pages- 
- - $r/iT£#evr  gd  £j/s£k  I>jfr2s7> 

?xDx“<rxxx 

\  f  V  _ _  rr..„  v 


XXXXXX 

XXXXXX 

xxxxxx 


X  No  Duplication  Fee  X 
X  for  this  page  X 
XXXXXXXXXXXXXXXX 


SE^S^T 

T° :  Finance  From:  Labor a tory 

Re:  p(>  ■HHHHB  03/24/2000 


(U)  Task  1.0  DRAGONET  Program  Funding  - 


PH# 


i£LJ)rsaonpf' 


L..nas  an„„immediate  need  foj 


§> 

PROCUREMENT: 

the  production 


The... con  tractor 
the  production  of; 


(O)  Task  '2.0  DRAGONET  Program  -  ??? 


{0}  Task  3.0  Threat  Analysis  Program 


cost  estimate  for 

5) 


^  .  ,,  <U)  The  contractor  shall  provide  software  upgrade 

Th software  maintenance  for  the  Technical 
i hi. eat  Analysis  database  and  the  Special  Projects  database  it 
contractor  shall  suprdv  a  software  swinssr  „,'fs  3  d  ,ter  ‘he 
minimum  i*TOi  J  «r  ^  ^  *OItware  engineer,  wxtn  an  anticipated 
levei  of  EL--,  to  support  this  effort  at  a  rate  of  twen*v 
five {25}  hours  per  month.  uwt.m.y 

<U)  LOCATION  OF  WORK 

Research  Fi~iH-v  /™-?  fc?  ®pa®?  limitations  in  the  Engineering 
ea""n  iEhz)  f  it  will  not  be  possible  to  perform  ^11 

services  at  the  ERF' s  facility.  Accordingly,  the  Contactor 
X  COnduct  ®P««tions  in  an  external 'location 

externaf  FB.T  r?®erves  the  right  to  approve  any  such 

external  facilities  snouid  a  contingency  arise. 


IX,  (U)  GOVERNMENT  FURNISHED  EQUIPMENT 

documentation  and  rrJ1  fur3?lsh  hardware,  applicable 

iden frf?X5  k»  1  d  additional  GFE  requirements  that  should  be 
identified  by  the  contractor  in  hxs  proposals. 


{ U }  PROGRAM  MANAGEMENT 


S/24/02  Release  -  Page 


secJ&t  ^ 

rkpsnc^i^rom^iLaboratory 
Re:  X  03/24/2000 

xs> 

W  T°  provide  managerial  and  administrative  support 
for  the  FBI’s  programs.  Scheduling,  task  assignments  and  budgets 
Sdt  n  .  <?enerated-  Monthly  status  reports  and  other  relevant 

(P|40)  documentation  shall  be 

Representative  (COTR)  at  required  intervals, ^  Thes^reports^are0 ^ 
to  include  monthly  progress  during  the  previous  period  and 
expected  progress  for  the  following  monthly  period.  Budgeting 
£o?tl0n'  xncl?ding  expenditures  to  date  is  to  be  provided  to 
the  FBI  on  a  monthly  basis.  As  part  of  the  contractors  oroaram 
management,  responsibilities,  the  contractor  shall  inform"  the 
FB_^s  Contracting  Officer  {CO}  and  Contracting  Officer’s 
technical  Representative  {COTR} ,  in  writing,  when  any  of  the 
tasks  reach  a  seventy  percent  (70 % 5  spending  level.  The 
contractor  shall  also  provide  a  cost  analysis  of  the  remaining^ 

^  ^  ^  °  n u .  ^  , 1  e  c* u  t  e  ^  $  r>  £  s  t na  t  s  h o vr  t  h  e  r e ma  i  n  i  n  g  f  u n  d  s  are 

su^ricient  or  insufficient  for  completing  the  task* 


Sl3SRB£ 


5/24/05  Release  »&£«  #57 


i 


To:  Finance  From: 


SEC^T 

jratory 

03/24/2000 


LEAD (s)  : 

Set  Lead  1: 


FINANCE 


AT  WASHINGTON .  DC 

+.U-,  xrv  {U)  That  the  ECU  increase  the  funding  for 

^8^^^0iB>lcontract  bV  51, 045, 000  for  fiscal  year  2000, 
-n  support  o^^i^^ragonet  and  Technical  Threat  Anal  vs  ^  s 
programs 


Set  Lead  2: 


laboratory 


AT  WASHINGTON.  OF 


(0)  For  in formatii 


only. 


Set  Lead  3: 


national  security 


AT  WASHINGTON.  DC 

<U)  For  information  on.lv. 


SEQfET 


S/24/02  Release  -  Page  858 


OPCA'29  (i2-3-%> 


v  ,  !  xxxxxx 

xxxxxx 

FEDERAL  BUREAU  OF  INVESTIGATION  XXXXXX 

FOIPA 

DELETED  PAGE  INFORMATION  SHEET 

—  “  thiS  “  *  *  Sle‘  °ne  °r  ni0re  °f  lhc  *°*!ow*tt§  statements,  where  indie, 

°  refe^rLyou  *"**  pmamS‘  **  CXCmpitons  ilidkated  below  ™  segregate  material  available  for 


Section  552 

Section  5S2a 

□  (b)(1) 

o  (b)(7)(A) 

o  (d)(5) 

O  (b)(2) 

□  (b)(7)(B) 

□  (i)(2) 

n  (b)(3) 

□  (b)(7)(C) 

a  (k)(i> 

- - -  --  .  ..... - 

— - 

□  (b)(7)(D) 

a  (k}(2) 

- - — - - 

— 

□  (b)(7)(E) 

a  (k)(3) 

- - - -  - -  - 

□  (b)(7)(F) 

□  (k){4) 

o  (b)(4) 

□  (b)(8) 

O  (k)(S) 

a  (b)(5) 

O  (b)(9) 

O  (k)(6) 

a  (b)(6) 

□  00(7) 

request  is  listed  in  the  title  only.  '  ’  ^  w  01  >mr  ***«  or  **  ***** 

□  Documents  originated  with  another  Government  agency  (ies).  These  documents  were  referred  to  that  ageneyfi 
for  review  and  thrtci  response  to  you, 

- Pages  comam  information  furnished  by  another  Government  agency(ies).  You  will  be  advised  by  the  FBI  as 

to  toe  releasabilny  of  tins  information  following  our  consultation  with  the  other  agency(ies). 

- —  *?ge(s?  Wlthheld  inas™ch  **  a  fma!  rekase  determination  has  not  been  made.  You  will  be  advised  as  to  tht 

disposition  at  a  later  date. 

— -  Pages  were  not  considered  for  release  as  they  are  duplicative  of 

-  psge(s)  withheld  for  the  following  reasons):  'Td 

~ . — . . . . ASL.^2Mll  cr  ~ . " 

Thefoli  owing  number  isto  be  used  for  reference  regarding  these  pages: 

— — O  ^  7)rhrm?i>  J2*/X  Jt&i 


xxxxxxxxxxxxxxxx 

Y.  X  Deleted  Pfl£r/»teV  V 


xxxxxx 

xxxxxx 

xxxxxx 


X  Deleted  Page(s)  X 
X  No  Duplication  Fee  X 
X  for  this  page  X 
XXXXXXXXXXXXXXXX 


<pv  . 


v/ 

SECJ^T 

STATEMENT  OF  WORK 


P  1  t  St 5 “ ?  ?*'*fi* |  ( 

v 


v«» 


/ 


(U)  STATEMENT  OF  WORK 
FOR  FY  2000 


(ADDITIONAL  TASKING) 


DRAGONET 

THREAT  ANALYSIS  PROGRAM 


June  lf  2000 


MAR  20  lust1  At*-t3<?&7’7 
CLASSIFIED  BY:  j 

REASON*  15  (eO 
DECLASSIFY  ON;  X  ±JS\ 


Page  1 


5/24/02  Release  -  Pagep?9 


Doc,  ^cc 


STATEMENT  OF  WORK 


STATEMENT  OF  WORK 


TABLE  OF  CONTENTS 


SECTION 
X  * 

XI. 

I XX, 

IV. 

V. 

VI. 

vix. 

VIII 

XX. 

X. 


TITLE 

—***&■  PAGE 

W)  INTRODUCTION .  * 

<u>  project  description  by  tasking  areas  . . .  .  3 

(U)  TASKING  AREA  #2.8  -  RENAMING  TASK. . .  .  ,  3 

<U)  TASKING  AREA  #2.14  - 

yy '  ’ *  * 

(U)  TASKING  AREA  #4.3  -  DRAGONET  - 

(O)  TASKING  AREA  #4.4  -  DRAGONET  -  HIGH  SPEED  INTERCEPT 

STUDY . . .  4 

(U)  TASKING  AREA  #6.0  -  THREAT  ANALYSIS  PROGRAM  ...  4 

<U)  LOCATION  OF  NORK . 

*  *  *  p  %  *  ‘  *  * . --•****.>  4 

<U)  GOVERNMENT  FURNISHED  EQUIPMENT.. . .  4 

(U)  Program  Management  . . .  5 


SE5jj^2T 


Page  2 


has  been  and  ij 


v  _ This  SOW  will  incorporate 

?nnn  tasklng  and  taskin9  modifications  for  the  current  *F 

2000  contract  J-F8I~G0-O80.  ^  c 

IX.  <U)  PROJECT  DESCRIPTION  BE  TASKING  AREAS 


,he  tasking  {Tasking  numbers  are  referenced  to 

me  original  contract  tasks} :  • 

— - — - j-iHi — Area  Summary  Table 

TASKING  AREA  ,  TASK  DESCRIPTION 


TASKING  AREA 
M 


RENAMING  TASK 


fT  ASKING 


ORAGO 


DtvAvaON &T  ~  High  Speed  Intercept  Study 
Technical  Threat  Analysis  Program  -  Data  Base  suppoi 


(o)  Sections  III,  IV,  V,  VI,  and  V; 
description  ox  the  tasking  for  FY2000. 


give  a  more  detail* 


XXX.  <U)  TASKING  2.8  -  HAWKING  ROUTER  ENHANCEMENTS  : 

(U) This  task  has  been  renamed  VIKING  ENHANCEMENTS 


IV  (U)  TASKING  2.14 


'ASKING 


5/24/02  Release 


3 


SE^^ET 

STATEMENT  OF  WORK 


VI . 


(U)  TASKING  AREA  #4.4  HIGH-SPEED  INTERCEPT  STUDY 


provide  the  DRAGON ET  program  with  a 
l  for  Internet  data  intercept'3  on  The 

nvlr^ft0r  fhaXhRiak\enhance®e^ts  to  existing  Carnivore  intercept  drive 
svstem  throughput  performance.  These  enhancements  will  mak€ 
operating  system  performance  enhancements  to  include  service  pack  1 ! 
additional  capability  that  will  be  added  in  addition  to  overall  thrc 
Carnivore  to  filter  on  PPP  streams  and  the  update  of  the  graphical 
filter  associated  with  PPP. 


use 

with 

ughp 

ser 


VII.  {0>  THREAT  ANALYSIS  PROGRAM 


Page  4 


5/24/02  Release  -  Page  #82 


SECjqp 

STATEMENT  OF  WORK 

,  ^  fne  contractor  shall  provide  software  upgrade 

installation  support  and  software  maintenance  support  for  the 
Technical  Threat  Analysis  database  and  the  Special  Projects 
database.  The  contractor  shall  supply  a  software  enaineer,  with 
an  anticipated  minimum  level  of  EL-4,  to  support  this  effort  at’ a 
rate  or  twenty  five  (25)  hours  per  month . 


VIII ,  (U)  LOCATION  OF  WORK 


oy  them.  FBI  reserves  the 
facilities  Should  ,:t 


ouia  a  contingency  arise. 


gat  to  approve  any  such  external 


IX.  (U)  GOVERNMENT  FURNISHED  EQUIPMENT 


documentation  and  addi 
identified  hv  thA  rrmi- 


"Vs u,:Vi! ", 4 1  x A  r u rn A sh  na rdwa re ,  app  1  i cable 
no  additional  GFE  requirements  that  should  be 
he  contractor  in  his  proposals. 


X.  (O')  PROGRAM  MANAGEMENT 

pbt • « r°Vic®  m®n??eriai  and  administrative  support  for  the 
bcneouimg,  task  assignments  and  budgets  shall 
^  9®^® rated.  Monthly  status  reports  and  other  relevant  FBI 

°iUCt  (PM0)  document®tion  shall  be  generated 
t  to  the  rSI  Contracting  Officer’s  Technical 

Representative  (COTR)  at  required  intervals.  These  reports  are 
"-°  delude  monthly  progress  during  the  previous  period  and 

infoSJ^fr0greS?  ?r  the  foilwi*HI  monthly  period.  Budgeting 
Sf  ™  i"C,Tfn?  ^^itures  to  date  is  to  be  prcvided'to 

“  on  3  oasis.  As  part  of  the  contractors  program 

management  responsibilities,  the  contractor  shall  inform* the" 

- s  wontracting  Officer  (CO)  and  Contracting  Officer 
Technical  Representative  (COTR) ,  in  writing,  when  any  of  the 
tasks  reach  a  seventy  percent  (70%)  spending  level.  The 
contractor  shall  also  provide  a  cost  analysis  of  the  remaining 
.unas  ana  time  requirements  that  show  the  remaining  funds  are* 


Page  5 


$74/02  ReJea.se  -  f>3fie  8S 


ufficient 


STATEHERT  OF  WORK 


or  insufficient  for  completing  the  task. 


SE 


Page  6 


5/24/02  Release  -  Page  884 


OPCA-20  (12-3-96) 


XXXXXX 

xxxxxx 

XXXXXX 


FEDERAL  BUREAU  OF  INVESTIGATION 
FOIPA 

DELETED  PAGE  INFORMATION  SHEET 

- Pagefs)  withheld  entirety  at  this  location  in  the  file.  One  or  more  of  the  following  statements,  where  indkLed 

explain  this  deletion.  '  * 

O  Deletions  were  made  pursuant  to  the  exemptions  indicated  below  with  no  segregate  material  available  for ! 


release  to  you, 

— — n  552  Section  SS2a 

°  WO  O  (b)(7)(A)  □  <d)(5) 

D  <bX?>  □  (b)(7)(B)  □  (jX2) 

°  <b><3>  O  (b)(7)(C)  □  <k)<l> 

- - - - .... - a  (b)(7)(D)  □  (k)(2) 

.... - □  (b)(7)(E)  p  (k)(3) 

- -  □  (b)(7)(F)  O  (k)(4) 

D  (b)(4>  □  (b)(8)  □  (h)(5) 

°  (b)<5>  □  (b)(9)  □  (k)(6) 

□  (b)(6)  n  (k\n\ 


□  Information  pertained  only  to  a  third  party  with  so  reference  to  the  subject  of  your  request  or  the  subject  of  .your 
request  is  listed  In  the  title  only,  *  - 

°  documents  originated  with  another  Government  ag«tcy(ies).  These  documents  were  referred  to  that  agency  res) 
for  review  and  direct  response  to  you.  "  '*  * 

-  Pages  contain  information  furnished  by  another  Government  agency (ies).  You  will  be  ad  vised  by  the  FBI  ts 

to  the  reliability  of  this  information  following  our  consultation  with  the  other  ageney(ies), 

- —  withheld  inasmuch  as  a  final  release  determination  has  not  been  made.  You  will  be  advised  as  to  i  j© 

disposition  at  a  later  date,  * 


.  Pages  were  not  considered  for  release  as  they  are  duplicative  of 

jL~~  withheld  for  the  following  reason(s):  n<‘£  //j££S  /%t/i  7W/£  /C&feXr 

. . . .  . ~a?"  JUmmot 


Yhe  following  number  is  to  be  used  for  reference  regarding  these  pages' 

l>A£.mmTL  £7  fy  je*o  r^cwcj/ 


xxxxxx 

xxxxxx 

xxxxxx 


xxxxxxxxxxxxxxxx 

X  Deleted  Page(s)  X 
X  No  Duplication  Fee  X 
X  for  this  page  X 
XXXXXXXXXXXXXXXX 


n  m  w  *</»  a  rto 


.«•»  -  /  :::4I 

To:  Finance  Laboratory 

Re:  268~HQ~1092598,  06/16/2000 


LEAD (3) l 

Sat  Lead  I  (Ada) 


FINANCE 


The  Finance  Division  is  requested  to  modify  Contract 
Number  j-fbi-oq-gso. 


Set  Lead  2  (Adm) ' 

CRIMINAL  INVESTIGATIVE 


*1 


AT  WASHINGTON.  DC 

To  approve  funding  for  requisition  number  827303  from 
budget  line  item  ETX122 .  in  the  amount  of  $347,730,  modifying 
contract  J-FBI-00-080 


Set  Lead  3  (Mm) 

LABORATORY 

AT  OU ANTI CO .  VA 
For  information  only. 


♦♦ 


3 


if 


'HSY.  5.2333  4 : 25PJ1 


DRAFT 


REQUEST  FOR  APPROVAL  OF  TESTING 

fiS—SIfl . . .  E I  ft  CT  R  OH  XC_  S17R VEI  LLANO  B  EQUIPMENT 


SENSITIVE  ELECTRONIC  TECHNIQUE  INFORMATION  INCLUDED 

‘  DISCLOSE 

2 


Sf2m ^Refe^. 


&*St  #91 


OFFICE 


draft 


A^yJ^Departnttat  of  Justice 


Federal  Bureau  of  Investigation 


<" »  ft!  '  1,1  y  ,  wVshtr.poa, D.  C,  20535*000 J  ~~  - - - ■— 

>  JvW^C  kt  M  'Tie  -form.  <rt-^  mznm*  4ucS% 

Ht*u>  fvsm  fAc  hfhxAfr,  Hay  5,  2000  CLASSIFIED  8Y; JtiHltH 

5WU  fe-c  ^>&c^CT,  REASON:  1,5  fe.jj 

ff*s  KLO  _  '  DECLASSIFY  G 

BEOuEST^FOP.  approval  OF  TESTING 
^SURVEILLANCE  E 


i  urn  i 


iem 


ENSXTIVE  ELECTRONIC  SURVEILLANCeAhXIQVE  INFORMATION  INCLUDED 

BO  NOT<BXS5lBs£  w 

Y^F'  5/24/82  Release  -  Page  S 


mV.  s. 


4.‘Z5R1 


:  office 
* 


DRAFT 


REQUEST  FOR  APPROVAL  OF  TESTING 

lUCTRONIC  SURVEILLANCE  EQUIPMENT  ^ 


HO. £29  P.5 


my.  5.2 


4:27PM 


^Xj 


kewtn  s^‘  he  Hmited  in  extent  and  duration  to  that  necessary  tn 

$wFaa!f CtP?,biiily  tbe  e?u5pment,  including  refinine  th*nr*e4«irm  «#Vfc*  I~.s5!L„. 

testing  herein  shad  not  exceed  90  cays  without  the  i 
-ge«gne»-&f  the  Attorney  Qensfal.  t^5  in) 

7»  O’f^ghl:  FBI  ID  testing  herein,  including  compliance  whh  (he  orace^ure*  «*  «%,»»,  J  v 

herein,  shall  be  closely  monitored  by  the  FBI  LD’s  C&f  of  the  Cyber  Tedu&ogy  Section: 


SENSITIVE 


ELECTRONIC 


SURVEILLANCE  TECHNIQUE  INFORMATION  INCLUDED 
DO  NOT  DISCLOSE 


ATTACHMENT  3 


S/24/H2  Release 


Page  898 


Memorandum 


ACTION  MEMORANDUM 


o 


SB 

Mrs*  Frances  Fragos  Townsend 
Counsel,  Office  of  Intelligence 
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(U)  The  Carnivore  software  has  been  developed  and 
tested  over  a  period  of  years  and  has  been  deployed  in  the  field 
successfully  on  numerous  occasions.  However,  it  has  never  been 
installed  in  the  USA.NET  network.  While  most  networks  use 
slandaxd  protocols,  protocols  can  vary  widely  from  the  standards 
in  some  networks* 


T 

-2~ 
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SEafET 


EXECUTIVE  SUMMARY 


TO;  THE  ATTORNEY  GENERAL 

THROUGH:  MRS.  FRANCES  FRAGOS  TOWNSEND 

COUNSEL,  OFFICE  OF  INTELLIGENCE 
POLICY  AND  REVIEW 

FROM:  LOUIS  J.  FREEH 
DIRECTOR,  FBI 

SUBJECT:  <U)  REQUEST  FOR  APPROVAL  OF  TESTING 

OF  FBI  ELECTRONIC  SURVEILLANCE  EQUIPMENT 

ACTION  MEMORANDUM 


:°  ofotain  Attorney  General's  approval  of  th* 

attached  FBI  electronic  surveillance  te^t-i-i^  •> 

testing  procedures  pursuant 

^.o  t\  ty  vc  steed.  in  chp  Attso^n^v  t-  *  ^  i  " 

t.K„  r  -  i,.  u0'*'ne>  General  in  Section  105(f)  of 

codified  SO  S:sxeni805maillanCe  ACt  °f  1978  <FISW  ' 

propose d^FB I  AtCorn1y  Seneral  >=  requested  to  approve  the 

proposed  FBI  testing  procedures  as  soon  as  possible.  Testino 

pursuant  to  these  procedures  is  essential  for  the  FBI  to  be  ab'  ) 


ClassT?"^ 

DeclassiJ 


MAR  2  <>  2S8*  314-7 *?  < 

CLASSIFIED  BY; 

REASON:  1.5  (cTTr^gi; 
DhCUS$IFyOM;X  f 


Sft^T 
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Memorandum  to  The  Attorney  General  fro 


m  Director, 


FBI 


APPROVE  _ 

DISAPPROVE 
OTHER  _ 


S&^ST 
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uccf  IS  UHClASSIFkB  BsJ-Hh 


i 

memorandum  for  the  attorney  general  £ 

THROUGH;  MRS.  FRANCES  FRAGOS  TOWNSEND 

PO^rv^i  OFFICE  OF  INTELLIGENCE 
rOLlCi  AND  REVIEW 


2  L>  zm  tint  s^uny  . 

CLASSIFIED  BY:  *»H\  C#  j 
REASON:  1.S  ‘'{FJT~C3f 
DECWSSiri'OftVl  4&j 


FROM;  Louis  J .  Freeh 
Direct or ,  FB I 

SUBJECT;  (U) ^REQUEST  FOR  APPROVAL  OF  TESTING 
J'  i'HI  ELECTRONIC  SURVEILLANCE  KOUTP? 


UIPMENT 


ACTION  MEMORANDUM 


PU«POot ;  <U>  To  obtain  the  Attorns  Ge^er^l  <« 

attached  FBI  electronic  surveilit  ce  "SL  ?  approval  of  the 

to  authority  vested  in  the  At to'*nL "rIC  ‘ ~V^ ■ pI oce<^ures  pursuant 

the  PoreignLnteUiq^ce  S^ei^wr^efai/n  Section  105(f)  of 

codified  at  50  uis.C  Jfi05{f)  1978  <FISA) , 

’TIMETABLE:  fVf  The 

proposed  FBI  cLf- Vnr/L  n®7  '°enerax  13  requested  to  approve  the 
e?  testinS  procedures  as  soon  as  possible  P 


(U)  ClassTSs^Td  by: 
Declas^ifW  on : 


5l^HT 
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Memorandum  from  Director,  FBI  to  The  Attorney  General 
Re;  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 
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SB 


Memo^ndum  from  Directs,  FBI  to  The  Attorney  General 
REQUEST  F0R  APPROVAL  OF  TESTING,  May  11,  2000 
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Memorandum  from  Direofcor-  pot  *  mu 

&e*  rpotipqt  poo  FBI  to  Ti:ie  Attorney  General 

Re.  REQUEST  FOR  APPROVAL  OF  TESTING,  May  U,  2000 


S/24/02  Retese  -  Page  92 


SE^sT 

Memorandum  from  Director,  FBI  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  II,  2000 


that'  in  important  respects,  filters  and  then” 
Wlt?  9fe3u  precision  various  ISP  data  elements 

rert-A-ir,  of  c°nt®nfc  ^hen  authorized)  based  upon  reference  to 
ceitam  standardized  ISP  TCP/IP  protocols. 


tretJOj 


Non-ta 


un  ' L"!'*  ~  ’ .  All  FBI  testina  sha 

Cst.  conaucted  in  sucli  3  w&v  t/fast  iti  wi  1 1  nr^,h  +-  *  v..._  _ f.  ^ 

J  ar  i:  WXX1  noc  targeted  jagamst 
the  communications  of  any  particular  person  or  persons .  /if) 


{fa,  .  ^FO/roJ  7*  auction:  The  testing  herein  shall  be 
limited  m  extent  and  duration  to  that  necessary  to  determine  the 

the&eiu^y  °5  th»  e<*¥ipment'  including  refining^ the  precision  of 
the  equipment.  Testing  herein  shall  not  exceqd  90  days  without 
the  prior  approval  of  the  Attorney  General. 


.  ,  (R0U&}  8.  Agency  Oversight:  FBI  LD  testing  herein 

including  compliance  with  the  procedures  set  forth  herein  «ha"i  3 
be  closely  monitored  by  the  FBI  LD's  Chief  of  the  Cyber  ' 
Technology  Sect  ion.  ||A 
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Memorandum  from  Director,  FBI  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11*  2000 


Hr  QUO}  9-  Report ing :  Upon  completion  of  the  testing 
herein,  the  FBI  LD  shall  submit  a  summary  report  to  the 
Department  of  Justice's  Office  of  Intelligence  Policy  and  Review 
briefly  setting  forth  the  results  of  the  testing,  stating  its 
compliance  with  these  testing  procedures,  and  identifying  the 
duration  of  the  test  ing 

RECOMMENDATION:  Attorney  General  approve  the  attached  electronic 
curve ill ane e  test! ng  p r oce du re s , 


APPROVE  _ 

DISAPPROVE 

OTHER 


Concur r ina  component s ; 
NOME 

Noncononrrina  components ; 
NONE 
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Subject  (U)  REQUEST  FOR  APPROVAL  OF  TESTING 

OF  FBI  ELECTRONIC  SURVEILLANCE  EQUIPMENT 

ACTION  MEMORANDUM 


SEp^ET 

Memorandum  from  Deputy  Director  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 
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SB 

Memorandum  from  Deputy  Director  to  The  Attorney  General 
Re:  REQUEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 


tFOUG-}  Proposed  Procedures : 
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SE$&ET 

°epUty  Director  to  The  Attorney  General 
Re:  REQJEST  FOR  APPROVAL  OF  TESTING,  May  11,  2000 


-frouc)  ?.  Duration:  The  testing  herein  shall  be 

i? Se  <•*•»*»•  »• 

tv  -  '  '  .  ,  ‘*3  rerd.na.ng  tne  precision  of 

.  -testing  herein  shall  not  exceed  eta  ^ «.„•«.*,>.  i'“ 

•  appi oval  or  the  Attorney  General. /(A 

including 

5fllo?*ly  Jonitore<3  by  Che  FBI  w*  Chief  ot'lhe  Cytir""’ 
-technology  Section.  At  X  “ 


herein  th^FR?  r  * '  j^F-^P*  Upon  completion  of  the  testing 

of  S?ef^  ***’“*  ?°  «• 

briefly  setting  forth  the  results  of 

compliance  with  these  testina  procedures  » J  iX, 5f,f ^  *ts 
duration  of  the  testing.^  P  JrtS'  *ud  -^ntifymg  the 


seMt 

?6- 
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MEMORANDUM  FOR  THE  ATTORNEY  GENERAL  6/1/00 

THROUGH;  MRS,  FRANCES  FRAGOS  TOWNSEND 

COUNSEL,  OFFICE  OF  INTELLIGENCE 
POLICY  AND  REVIEW 

FROM-  LOUIS  J,  FREEH  fe 

DIRECTOR,  FBI  {j?K£HV/JS£  .C 

SUBJECT;  (U)  REQUEST  FOR  APPROVAL  OF  TESTING 

OP  FBI  ELECTRONIC  SURVEILLANCE  EQUIPMENT 

ACTION  MEMORANDUM 


attached  FB^elSctro^S  ™<e f toiney  General's  approval  of  the 
to  authority  vested  in  the  A-torS^rS8^?3- pr?Cedures  Pursuant 

=Sii?r'i3r  inteiii9“c^u™“i"«  Ac^of“9?^m?sA!■'l5(f,  of 

coax fied  at  50  u*S.C,  1805(f)  ^ISA)  , 


attached  FBI 

h  Ci  vf  V,  ,-x  w  4  v.  »  . 


TIMETABLE:  (M  Th<~-  .  . 

.  ,  A  **w  A^^orney  vyeuersl  is  reoue<3ted  r ,, v  .  , 

pioposea  FBI  lestina  nrocedtir-Pe  H  e°lCQ  Lo  approve  the 

•nr-ena»-.t  P'-^teauies  ess  soon  as  possible 

ursuant _ to  these  nroeedm-v»«  ■>«  .  .  _l 

se  FBI 


8P*HQ-X0X24» 


,  Roor 

ft  714 

2 

Room 

r  Tjf  >Sp. 

■ 

|  iioom 
[  Room 

1  Root 

ii>  *1 

Room 


—  -  — —  f  ^oom  3090 
Mr*  Allen,  QT  erf 


1 
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Memorandum  from  Director  frt  f-r*  Thj»  «, 

e?£>+  ppnr?pcm  f  *  The  Attorney  General 

Ke*  REQUEST  FOR  APPROVAL  OF  TESTING 
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SEC 

i. 

Memorandum  from  Director  fpt 

Re:  REQUEST  FOR  APPROVAL  OF  TESTING  ®Y  General 


:ware 


nr  oar*  a  1  VUi:e  is  an  FBI-desiwS! 

intercepts  with  great  *nrec^!!^rfc^fc •  resPects<  filters  and  thfn 
(including  content  wLf!  ^10-  V*P?US  1SP  data  elements 
certain  standardised  ISP  TCP/fpSJ?ofcScolf . UP°U  reference  to 


(FOOD)  4.  Mon-taraeted  testiner-  an  rat 
be  conducted  in  such  a  waTThSTi^^^t t  sha11 

the  communications  of  any  particular  rw’r-^n  targeted  against 

y  Rarticuxar  person  or  psrsonsAf. 


limited  in  ^extent-  ~  testing  herein  shall  be 

capabilitv  nf  *-k  Q  duration  to  that  necessary'  to  determine  H,a 

the  S,h  £L  5  ht  shipment,  including  refining  the  mSlSt  *5® 
rne  equipment.  Testing  herein  *1  §  cne  Precision  of 

the  prior  approval  of  the  Attorney  GeSera^g®  90  days  without 
including  SSuance^fth^hl^^Sure^ec^fo???1?3  h?rBin' 

JtfiSSg  che  ra?  “r*  Chiefs  ’ f?shc^srn- sha11 
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SFj 

Memorandum  from  Director,  FBI  to  The  Attorney  General 
He.  REQUEST  FOR  APPROVAL  OF  TESTING 

herein,  the^FBl '  LD  *  ,  ^P°n  completion  of  the  test inq 

gepart^nt  <*  JuSice-sMHof  of  SESfJZSto&J?*  *  „  ” 

duration  of  the  testing  (gj  "  P  d  1  £,f  an<i  identifying  the 

?u-SJ???DATZON:  Attorney  General  approve  the  attached  *. 
surveillance  testing  procedures.^  jl  attached  electronic 


approve 


DISAPPROVE 

OTHER 


££L.qurrir}g__cornpgnents: 


HONE 

Himsoncurrinq  comaon^tvc 
NONE 


S/24/02  Release  -  Pae<®27 


} 


Memorandum  from 
He:  REQUEST  FOR 


Dn£nCt°r'  FSI  to  T^e  Attorney  General 
APPROVAL  OF  TESTING  1 


-  t  , 
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